Overview

overview

10

Static

static

3

0c7ff96274...6b.exe

windows7-x64

10

0c7ff96274...6b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 14:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0c7ff96274c72b9094e87f0ca0cd1177c978843d5a1903719639a78be78d3a6b.exe

  • Size

    2.8MB

  • MD5

    1a59c533c2c250dbbc946f54ad42385b

  • SHA1

    58140184ea8526200170257102990cde9ad5cac6

  • SHA256

    0c7ff96274c72b9094e87f0ca0cd1177c978843d5a1903719639a78be78d3a6b

  • SHA512

    080034090d0cb62fb9190915f74a8e9c9b44861444e6d00c12b1e174c39203b90607a382021545b808260785117fbf563f4883d0b61acea6d86f1400c57cd96a

  • SSDEEP

    49152:JTcn/PML+zUkQdibMjWny1lZOvTctJJk9UTcVczSlYfJJ:JEHML+zUz2mWnvYSYH

Score
10/10
amadeycryptbotdcratlummastealcxmrig9c9aa5stokdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

https://tacitglibbr.biz/api

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

Extracted

Family

cryptbot

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://shineugler.biz/api

https://tacitglibbr.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Process spawned unexpected child process 6 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • XMRig Miner payload 10 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 27 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c7ff96274c72b9094e87f0ca0cd1177c978843d5a1903719639a78be78d3a6b.exe
    "C:\Users\Admin\AppData\Local\Temp\0c7ff96274c72b9094e87f0ca0cd1177c978843d5a1903719639a78be78d3a6b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2668
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe
        "C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:900
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1792
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Bridgecontainerserver\SlMo.bat" "
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2428
            • C:\Bridgecontainerserver\BrokerhostNet.exe
              "C:\Bridgecontainerserver/BrokerhostNet.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1296
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\conhost.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:2840
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Bridgecontainerserver\BrokerhostNet.exe'
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                PID:1984
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\jCNTH53Sk3.bat"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2176
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  8⤵
                    PID:2260
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    8⤵
                      PID:2948
                    • C:\Users\Admin\AppData\Local\Temp\conhost.exe
                      "C:\Users\Admin\AppData\Local\Temp\conhost.exe"
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1648
          • C:\Users\Admin\AppData\Local\Temp\1016135001\6d77f45f4b.exe
            "C:\Users\Admin\AppData\Local\Temp\1016135001\6d77f45f4b.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1968
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 136
              4⤵
              • Loads dropped DLL
              • Program crash
              PID:376
          • C:\Users\Admin\AppData\Local\Temp\1016136001\925a6853c6.exe
            "C:\Users\Admin\AppData\Local\Temp\1016136001\925a6853c6.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2952
          • C:\Users\Admin\AppData\Local\Temp\1016137001\b073357b0b.exe
            "C:\Users\Admin\AppData\Local\Temp\1016137001\b073357b0b.exe"
            3⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1780
          • C:\Users\Admin\AppData\Local\Temp\1016138001\19f77457fc.exe
            "C:\Users\Admin\AppData\Local\Temp\1016138001\19f77457fc.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2080
            • C:\Users\Admin\AppData\Local\Temp\BQN11MYCL6FL7AAKSNL251KQV.exe
              "C:\Users\Admin\AppData\Local\Temp\BQN11MYCL6FL7AAKSNL251KQV.exe"
              4⤵
              • Modifies Windows Defender Real-time Protection settings
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Windows security modification
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2044
            • C:\Users\Admin\AppData\Local\Temp\CSTC7MSL23RZVIWK1.exe
              "C:\Users\Admin\AppData\Local\Temp\CSTC7MSL23RZVIWK1.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:1856
          • C:\Users\Admin\AppData\Local\Temp\1016139001\17aa563caf.exe
            "C:\Users\Admin\AppData\Local\Temp\1016139001\17aa563caf.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:1204
          • C:\Users\Admin\AppData\Local\Temp\1016140001\625cd2c275.exe
            "C:\Users\Admin\AppData\Local\Temp\1016140001\625cd2c275.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2304
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2064
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2564
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2196
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1804
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              4⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2940
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              4⤵
                PID:2896
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  5⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2840
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2840.0.278412553\1299153977" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1156 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11a5f6a9-fd49-47ff-81e0-6222014d0d6c} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" 1336 10ad5e58 gpu
                    6⤵
                      PID:2448
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2840.1.1924151898\762731135" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {987258ea-8529-4667-93eb-d87d492fa45a} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" 1512 43ed058 socket
                      6⤵
                        PID:2264
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2840.2.461931736\809467913" -childID 1 -isForBrowser -prefsHandle 1912 -prefMapHandle 1908 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5947aaa7-1032-412d-bd4e-1dfe3cf03fbe} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" 1924 18e84b58 tab
                        6⤵
                          PID:2128
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2840.3.735495830\1652055088" -childID 2 -isForBrowser -prefsHandle 2764 -prefMapHandle 2760 -prefsLen 26151 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e5771c61-3b52-4e24-9147-1652df505b62} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" 2776 1d691158 tab
                          6⤵
                            PID:3056
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2840.4.620439637\1958842685" -childID 3 -isForBrowser -prefsHandle 3724 -prefMapHandle 3708 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {478e4eed-71ac-4310-a94b-1268264b11f5} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" 3736 1e772258 tab
                            6⤵
                              PID:3584
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2840.5.359534514\815751541" -childID 4 -isForBrowser -prefsHandle 3940 -prefMapHandle 3772 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {641913b8-4dbb-4cf1-81f9-16b638f5b223} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" 3952 1e771358 tab
                              6⤵
                                PID:3600
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2840.6.197842542\451332974" -childID 5 -isForBrowser -prefsHandle 4068 -prefMapHandle 4072 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f52d21dd-74c2-45a3-a57b-cbc76e86b8e3} 2840 "\\.\pipe\gecko-crash-server-pipe.2840" 4056 1e771658 tab
                                6⤵
                                  PID:3652
                          • C:\Users\Admin\AppData\Local\Temp\1016141001\2341085c20.exe
                            "C:\Users\Admin\AppData\Local\Temp\1016141001\2341085c20.exe"
                            3⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2584
                          • C:\Users\Admin\AppData\Local\Temp\1016143001\0ce644d546.exe
                            "C:\Users\Admin\AppData\Local\Temp\1016143001\0ce644d546.exe"
                            3⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:2304
                            • C:\Windows\system32\cmd.exe
                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                              4⤵
                              • Loads dropped DLL
                              PID:3320
                              • C:\Windows\system32\mode.com
                                mode 65,10
                                5⤵
                                  PID:3336
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3236
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_7.zip -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1592
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_6.zip -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2016
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_5.zip -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:884
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_4.zip -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1632
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_3.zip -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3248
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_2.zip -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2260
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_1.zip -oextracted
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2616
                                • C:\Windows\system32\attrib.exe
                                  attrib +H "in.exe"
                                  5⤵
                                  • Views/modifies file attributes
                                  PID:1944
                                • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                  "in.exe"
                                  5⤵
                                  • Executes dropped EXE
                                  PID:3200
                                  • C:\Windows\system32\attrib.exe
                                    attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                    6⤵
                                    • Views/modifies file attributes
                                    PID:2684
                                  • C:\Windows\system32\attrib.exe
                                    attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                    6⤵
                                    • Views/modifies file attributes
                                    PID:2932
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                    6⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:2780
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell ping 127.0.0.1; del in.exe
                                    6⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2408
                                    • C:\Windows\system32\PING.EXE
                                      "C:\Windows\system32\PING.EXE" 127.0.0.1
                                      7⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:2320
                            • C:\Users\Admin\AppData\Local\Temp\1016144001\0675beee69.exe
                              "C:\Users\Admin\AppData\Local\Temp\1016144001\0675beee69.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:3500
                              • C:\Users\Admin\AppData\Local\Temp\1016144001\0675beee69.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016144001\0675beee69.exe"
                                4⤵
                                • Executes dropped EXE
                                PID:1492
                              • C:\Users\Admin\AppData\Local\Temp\1016144001\0675beee69.exe
                                "C:\Users\Admin\AppData\Local\Temp\1016144001\0675beee69.exe"
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:2116
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\conhost.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1028
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:820
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\conhost.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1292
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "BrokerhostNetB" /sc MINUTE /mo 10 /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1980
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "BrokerhostNet" /sc ONLOGON /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:2328
                        • C:\Windows\system32\schtasks.exe
                          schtasks.exe /create /tn "BrokerhostNetB" /sc MINUTE /mo 8 /tr "'C:\Bridgecontainerserver\BrokerhostNet.exe'" /rl HIGHEST /f
                          1⤵
                          • Process spawned unexpected child process
                          • Scheduled Task/Job: Scheduled Task
                          PID:1808
                        • C:\Windows\system32\taskeng.exe
                          taskeng.exe {1FC78EAD-2BE8-4C7A-B6F6-C00B79B52D2D} S-1-5-21-1846800975-3917212583-2893086201-1000:ZQABOPWE\Admin:Interactive:[1]
                          1⤵
                          • Loads dropped DLL
                          PID:4088
                          • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                            C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            PID:3080
                            • C:\Windows\explorer.exe
                              explorer.exe
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3940
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                              3⤵
                              • Drops file in System32 directory
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2812
                              • C:\Windows\system32\PING.EXE
                                "C:\Windows\system32\PING.EXE" 127.1.10.1
                                4⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:3112

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Hide Artifacts

                        1
                        T1564

                        Hidden Files and Directories

                        1
                        T1564.001

                        Impair Defenses

                        2
                        T1562

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        3
                        T1112

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        3
                        T1552

                        Credentials In Files

                        3
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        7
                        T1012

                        Remote System Discovery

                        1
                        T1018

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        System Network Configuration Discovery

                        1
                        T1016

                        Internet Connection Discovery

                        1
                        T1016.001

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Bridgecontainerserver\SlMo.bat
                          Filesize

                          89B

                          MD5

                          20c75fef4553c17d36635750cfb57049

                          SHA1

                          8489a5998acaa63326bc1a665c38eb71c5d1f426

                          SHA256

                          0dcef4794868f563d515bbeee69e35dde750411ee9dcaafdef597806c89cabd0

                          SHA512

                          2819f6585bd3ee7e9f1703c259b97b21dbacde276186a489acfea0c36f377f751845b50ed00a70e029e95f588193cf69f77aeaf2785e67888378b9f2e95ee92a

                          Download Submit

                        • C:\Bridgecontainerserver\VBxKsR3W5qREBSxxvIt5VpzoFdFFANtbsRk6NDfKSHeOxN7UsJds5Ck.vbe
                          Filesize

                          204B

                          MD5

                          e52eec5fe59f0e73555c7d43c0035f62

                          SHA1

                          e6fcc87b7d260c2fcfff89e28e7d45357357520e

                          SHA256

                          b5712ce1aa870e16ed1464f1ecd627aed7020bb48c61252471cf9ec0b2d38d7f

                          SHA512

                          325c467e6519fb72238c62abbb7b89d32016a71416d41f148a38e41853928fc9cc84ed6b096784af9b1ad23c3363316d6b4f3464959127dfee1794cc926d40a7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\activity-stream.discovery_stream.json.tmp
                          Filesize

                          23KB

                          MD5

                          c34e7c8f95c73d6330c417f359ba4d37

                          SHA1

                          2354ad10d25ac14030263501d90b7c0da7ddfc2e

                          SHA256

                          59c673919bd9f017e2e324e9684444f75c4addc3f9beaf0719f82d27904f5db4

                          SHA512

                          83519e99f52ee4611b852dbb82753e947ae7f671438e727512006cb136578b3bef8a16385986092825f111ccbfbc65c0fdefc7269deb124f958b6a0f59ed2a04

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                          Filesize

                          15KB

                          MD5

                          96c542dec016d9ec1ecc4dddfcbaac66

                          SHA1

                          6199f7648bb744efa58acf7b96fee85d938389e4

                          SHA256

                          7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                          SHA512

                          cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016072001\muNJF0r.exe
                          Filesize

                          2.2MB

                          MD5

                          b5a1474fcb8f7b9809d52546bd304af3

                          SHA1

                          8604fe586fa0d03adaa6608169a62c65c837de7d

                          SHA256

                          dc83dbd12c5a432a6c168982e55d6c7be89dd0bc4b915e3e93e3a97c8af0ab0d

                          SHA512

                          39931300c863c521957dd5d842c0c6e0d66d2b43663136375e21feb26181bd1c9d4494025e0e7a00b80b51405d1e67bfe825787e60c1b99998463b4e3a49a7ee

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016135001\6d77f45f4b.exe
                          Filesize

                          418KB

                          MD5

                          78550f31347263e7e577f6996e33bffa

                          SHA1

                          28b31ae0eeb6d6e7386cd01b11a3881614ce23c3

                          SHA256

                          60fbe8cb9c1985f16403d83b1874a7b01a1341b1d835225ec0d66d3ef769e134

                          SHA512

                          1dad1e4df168d05e6ea478f333edac08ad8a7a6d5d386c8c0eefef5b107bb432f3d87801a20ee98ec6849ee680ba0296bf9bb45628c4af989a7d478907a7b471

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016136001\925a6853c6.exe
                          Filesize

                          1.7MB

                          MD5

                          6c1d0dabe1ec5e928f27b3223f25c26b

                          SHA1

                          e25ab704a6e9b3e4c30a6c1f7043598a13856ad9

                          SHA256

                          92228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d

                          SHA512

                          3a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016137001\b073357b0b.exe
                          Filesize

                          4.3MB

                          MD5

                          64cfdc9caeaefbc21aeb85e1a82b3153

                          SHA1

                          ed719eaddd2875b2d590d0c14d036b42c8601cbc

                          SHA256

                          095372c51df528243c88389b2d833560eb4621cf213d8c6a0190d39e0ec0f24a

                          SHA512

                          cca4c8857c59ef279695caaf7b6065af95977f624dafdf5a71000cf9dcee3b24b39b417b3ed8faa67b161d88f195f37655222f51926b64e16db7b9f46a71f4bd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016138001\19f77457fc.exe
                          Filesize

                          1.8MB

                          MD5

                          9b88afc4511d0fe8aca6080d34f2dd66

                          SHA1

                          4d0abcc2f053e2b17d3064f65dffc171f873b043

                          SHA256

                          5d2b5f0d8b9fbfb231b99678bb332bee9cfef9aa6c2ed7e994dbabbb83639004

                          SHA512

                          f4e9c5bbbb27eb07c192226390833714b82b94cfa4a9fb6b0e0a75ece7b51eb009b9c2bdc3b70c2ee77a56b7496c1251c50888471cddf32a2f307eaf134b1490

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016139001\17aa563caf.exe
                          Filesize

                          1.7MB

                          MD5

                          e33dc32f04e77bc26482baccb87b9795

                          SHA1

                          e4a57ead636bd006cecb7d9ec5e9aa36432e1372

                          SHA256

                          b2ecbacaf99db2c41066c1914b8b3116b5e25683e6552802a24b08d00d563431

                          SHA512

                          13d735438d20b0d352719c6e32584ed6abfaad6092ff9124393b3f1c6d6aa4314d0ce27c16cc654583973369572ec823423be9be04e34c50184976c0a35c96cf

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016140001\625cd2c275.exe
                          Filesize

                          943KB

                          MD5

                          7204bb7d150d6d2b21a5ffe9f3a9a017

                          SHA1

                          3af67e498f6204a88e767ec34ced2ce5fb731373

                          SHA256

                          70dd93e3cad56f80a899295aef97bec87d01b2d2aba82d67ae79e0bea93f813e

                          SHA512

                          de172c438010a05116cf23507fc68001fb120b45f715ad46ce16f7c48424d172e149e4e9d400b1446685548c456857169029a4e2f0aa9789d24239295d7bd50f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016143001\0ce644d546.exe
                          Filesize

                          4.2MB

                          MD5

                          3a425626cbd40345f5b8dddd6b2b9efa

                          SHA1

                          7b50e108e293e54c15dce816552356f424eea97a

                          SHA256

                          ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                          SHA512

                          a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1016144001\0675beee69.exe
                          Filesize

                          710KB

                          MD5

                          28e568616a7b792cac1726deb77d9039

                          SHA1

                          39890a418fb391b823ed5084533e2e24dff021e1

                          SHA256

                          9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

                          SHA512

                          85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\jCNTH53Sk3.bat
                          Filesize

                          221B

                          MD5

                          4758ac8d4c8be3c9d1352be766a8948b

                          SHA1

                          0192c241b0ff88ecb7ba9e1bfb83e829764a9253

                          SHA256

                          a8931d812c8f70eb182f058114003ffb3523a8d7833a09471d9c0b3316b6f2c8

                          SHA512

                          80d2493a992f4c988cf0714261641e51978d0c2200d593a1a38b1ff14fefd9d93885664787e45c8c0c505c4826c22d5cd0f2182422dc751c126e21c7cd0c605d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                          Filesize

                          1.6MB

                          MD5

                          72491c7b87a7c2dd350b727444f13bb4

                          SHA1

                          1e9338d56db7ded386878eab7bb44b8934ab1bc7

                          SHA256

                          34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                          SHA512

                          583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                          Filesize

                          3.3MB

                          MD5

                          cea368fc334a9aec1ecff4b15612e5b0

                          SHA1

                          493d23f72731bb570d904014ffdacbba2334ce26

                          SHA256

                          07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                          SHA512

                          bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                          Filesize

                          3.3MB

                          MD5

                          045b0a3d5be6f10ddf19ae6d92dfdd70

                          SHA1

                          0387715b6681d7097d372cd0005b664f76c933c7

                          SHA256

                          94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                          SHA512

                          58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                          Filesize

                          440B

                          MD5

                          3626532127e3066df98e34c3d56a1869

                          SHA1

                          5fa7102f02615afde4efd4ed091744e842c63f78

                          SHA256

                          2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                          SHA512

                          dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                          Filesize

                          442KB

                          MD5

                          85430baed3398695717b0263807cf97c

                          SHA1

                          fffbee923cea216f50fce5d54219a188a5100f41

                          SHA256

                          a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                          SHA512

                          06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                          Filesize

                          8.0MB

                          MD5

                          a01c5ecd6108350ae23d2cddf0e77c17

                          SHA1

                          c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                          SHA256

                          345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                          SHA512

                          b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                          Filesize

                          7KB

                          MD5

                          5b29f83670c39a5f71a05f4de804f972

                          SHA1

                          6cd0ad20d3c6fad61753a50847d78c49734df02c

                          SHA256

                          c0f65e8fbd6cdcba8423ed3b26440ae9deba314bcb76edf73cf3fdf70abceab7

                          SHA512

                          a0ca45ef7017400f69f954d89d3f777e22ab5247232df977ae552f4799e8755c48091ed7b9fcf2263edd8d6bac8b23504b2eb383f6e5563f44b1cef09b7f607a

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\db\data.safe.bin
                          Filesize

                          2KB

                          MD5

                          59cc03cbe5d60c46a0310ed98d61e4fa

                          SHA1

                          249c5f9b53bdb5051020ecfed431435991491beb

                          SHA256

                          a7155093cbbe1037a544d5d1cbdb4f3d59be00ed99bbcbaaa8711a2d16154d91

                          SHA512

                          3b5407dcf69254f66ea4754f56f57ba84dfc8bb62fbc4afb261567f3b35d7c77ed2a7b46a9d94faa1927a7ae84acd83f075ff1dd68c1438bee08f6a3603f5448

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\3803703c-70ae-47a6-8e79-ea6963e098c2
                          Filesize

                          745B

                          MD5

                          3bff8a562125650f210e1abb08aa1775

                          SHA1

                          1a74b2164d91c6f5176790725cf5bcb633785ebb

                          SHA256

                          f0d463bad9e1d13a72f1959ad4891a1b1e7203a00b124e622455c54352daeb07

                          SHA512

                          5c3e300f290b2bddb4808aa055af8b7d5d401e2f40830aa1b3047900d633ca70dd947b0daaff6b7a98547be44ccc17f8f3f7b5db5b8bde8945f9a0d519574d44

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\datareporting\glean\pending_pings\6e7b9168-4e27-4b54-9e20-99fdc71e7be9
                          Filesize

                          10KB

                          MD5

                          9130b377c5cdb45a5254d6545ab16255

                          SHA1

                          862a5f4688e968757c237b77870750794f88fd20

                          SHA256

                          e83b0179c68fc4529979cb4f9b5386070315409b542195a95592a41d37a1f1c7

                          SHA512

                          1963217d8b870499d6c3e01794e1b59d368ee9936378b6463a00e2aacc6471e52c02d0e7f861c1bb6f6e0df59274bf7830f13faedce0d76d57d15a70eb9fda2c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                          Filesize

                          997KB

                          MD5

                          fe3355639648c417e8307c6d051e3e37

                          SHA1

                          f54602d4b4778da21bc97c7238fc66aa68c8ee34

                          SHA256

                          1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                          SHA512

                          8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                          Filesize

                          116B

                          MD5

                          3d33cdc0b3d281e67dd52e14435dd04f

                          SHA1

                          4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                          SHA256

                          f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                          SHA512

                          a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                          Filesize

                          479B

                          MD5

                          49ddb419d96dceb9069018535fb2e2fc

                          SHA1

                          62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                          SHA256

                          2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                          SHA512

                          48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                          Filesize

                          372B

                          MD5

                          8be33af717bb1b67fbd61c3f4b807e9e

                          SHA1

                          7cf17656d174d951957ff36810e874a134dd49e0

                          SHA256

                          e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                          SHA512

                          6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                          Filesize

                          11.8MB

                          MD5

                          33bf7b0439480effb9fb212efce87b13

                          SHA1

                          cee50f2745edc6dc291887b6075ca64d716f495a

                          SHA256

                          8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                          SHA512

                          d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                          Filesize

                          1KB

                          MD5

                          688bed3676d2104e7f17ae1cd2c59404

                          SHA1

                          952b2cdf783ac72fcb98338723e9afd38d47ad8e

                          SHA256

                          33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                          SHA512

                          7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                          Filesize

                          1KB

                          MD5

                          937326fead5fd401f6cca9118bd9ade9

                          SHA1

                          4526a57d4ae14ed29b37632c72aef3c408189d91

                          SHA256

                          68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                          SHA512

                          b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js
                          Filesize

                          6KB

                          MD5

                          a10e55e7449074b391ad94b774a4f899

                          SHA1

                          3642186bf84a79148583cb1c2f35178e251340dd

                          SHA256

                          6acd1bb3c500ee951ede1948ab7b2d00e2b84c870986e8bc80606abb0c4bed2b

                          SHA512

                          f474357177238e1a54f3902c62ded1a5ff187f83ce67f3286ecbf98817a57b386796e51c516a9a6d8da35711256a1cffd159b53adcc0216d186c15b9c0e0ad44

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          69a45f79577ab0b02b51d711033860e9

                          SHA1

                          6fc12950a0032c78c44515b12f4fc16209b73c42

                          SHA256

                          c7e8c2de66e9e1e12dc66fe35bd0b02eb3c6ee92f902648d830408dbc5c75adc

                          SHA512

                          7570e85c87d1fd417c16f5790e4851a7e6464a83c4fa1c30933a66ad6b5596fcdb5627588c78781d022a233e96c56ae4a59bd673bd72528522c4dc8ec30123f3

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\prefs-1.js
                          Filesize

                          7KB

                          MD5

                          9c73f2bdf149fd0e44f276473dfe2361

                          SHA1

                          bd488a080d232369a31ad9480639acf7b29a5668

                          SHA256

                          24b35fe69feb7ab6c33bcf2a3be91439ce72eed4d32f6ad86fb6e97c8a1bc150

                          SHA512

                          fd96da0db0f97a7f6b905935975e036abc587a8dc78e1b7ee4c6b8a5af5da7fcd0e1e28a6b0313dba984a85d326a2971bea33c39eda7e45f9416463724fbe5f4

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5nwvfgbl.default-release\sessionstore-backups\recovery.jsonlz4
                          Filesize

                          4KB

                          MD5

                          e125adecdecf84af8e8eca0f297a10f3

                          SHA1

                          1f7cd13427c7b8ec6470821cd7c1c535100017ef

                          SHA256

                          8f60f3c9fe1d819ed6e8142d38d660584793cced47d8645883a05626f1e6bfd0

                          SHA512

                          baf245934ece6565631f454733452027f8ee969ebc2a34e40b15d270d09d17d88a38a085717853fb23b7ef40540e5847795a43b30a72318cfcbc864c6179af8d

                          Download Submit

                        • \Bridgecontainerserver\BrokerhostNet.exe
                          Filesize

                          1.9MB

                          MD5

                          0f91548ca49c64d6a8cd3846854f484c

                          SHA1

                          033c309b683020221ae189c4236a70c0d3ddd568

                          SHA256

                          a7883947a5f3c0d74f3eac6c2a6da45555298d769f5e3137e10a3ece14e83dfd

                          SHA512

                          e207b5545ceed034ec22f13e1a36f13656721b2c9cab97f6ec7ba8195f32ddc1673e1334902b2d4fc0ce393baf7f806bedf4a03a26a8ffe79ad17a87cf9a90a2

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\BQN11MYCL6FL7AAKSNL251KQV.exe
                          Filesize

                          2.6MB

                          MD5

                          f86c08a75747002a2a7cd3fbc5fe05c8

                          SHA1

                          7b9776338fe3a06350c16bc62e927f5ba6490723

                          SHA256

                          5b4d3426cd705909f38f2a136e2a5a1e593fd66a68c01b0e715f533d20a4218a

                          SHA512

                          2b8ab4cb0d7aba429f5835462a1c16dd4d0bc1a13c40c5ddf27a900295ca3c168dba79b8af97b26f80017755514e43f71120f1c309dece1fabd41d9147e63790

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          Filesize

                          2.8MB

                          MD5

                          1a59c533c2c250dbbc946f54ad42385b

                          SHA1

                          58140184ea8526200170257102990cde9ad5cac6

                          SHA256

                          0c7ff96274c72b9094e87f0ca0cd1177c978843d5a1903719639a78be78d3a6b

                          SHA512

                          080034090d0cb62fb9190915f74a8e9c9b44861444e6d00c12b1e174c39203b90607a382021545b808260785117fbf563f4883d0b61acea6d86f1400c57cd96a

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\main\7z.exe
                          Filesize

                          458KB

                          MD5

                          619f7135621b50fd1900ff24aade1524

                          SHA1

                          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                          SHA256

                          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                          SHA512

                          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                          Download Submit

                        • memory/1204-183-0x0000000000050000-0x00000000006E5000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1204-182-0x0000000000050000-0x00000000006E5000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1296-138-0x0000000000610000-0x000000000061E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1296-146-0x0000000001FD0000-0x0000000001FDC000-memory.dmp

                          Filesize

                          48KB

                          Download

                        • memory/1296-142-0x0000000002010000-0x0000000002028000-memory.dmp

                          Filesize

                          96KB

                          Download

                        • memory/1296-140-0x0000000001FF0000-0x000000000200C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/1296-144-0x0000000000620000-0x000000000062E000-memory.dmp

                          Filesize

                          56KB

                          Download

                        • memory/1296-135-0x0000000000180000-0x0000000000366000-memory.dmp

                          Filesize

                          1.9MB

                          Download

                        • memory/1648-189-0x0000000000FD0000-0x00000000011B6000-memory.dmp

                          Filesize

                          1.9MB

                          Download

                        • memory/1780-379-0x00000000000D0000-0x0000000000D46000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/1780-113-0x00000000000D0000-0x0000000000D46000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/1780-427-0x00000000000D0000-0x0000000000D46000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/1780-432-0x00000000000D0000-0x0000000000D46000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/1780-179-0x00000000000D0000-0x0000000000D46000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/1780-184-0x00000000000D0000-0x0000000000D46000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/1856-316-0x0000000000A70000-0x0000000001105000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1968-70-0x0000000000400000-0x0000000000470000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2044-223-0x0000000000EA0000-0x0000000001150000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2044-221-0x0000000000EA0000-0x0000000001150000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2044-222-0x0000000000EA0000-0x0000000001150000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2044-420-0x0000000000EA0000-0x0000000001150000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2044-414-0x0000000000EA0000-0x0000000001150000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2080-210-0x0000000000D30000-0x00000000011DC000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2080-239-0x0000000006560000-0x0000000006BF5000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/2080-220-0x0000000006560000-0x0000000006810000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2080-219-0x0000000006560000-0x0000000006810000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2080-134-0x0000000000D30000-0x00000000011DC000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2080-186-0x0000000000D30000-0x00000000011DC000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2080-418-0x0000000006560000-0x0000000006BF5000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/2080-237-0x0000000000D30000-0x00000000011DC000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2116-643-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2116-645-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2116-641-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2116-639-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2116-637-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2116-633-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2116-635-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2116-647-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2116-646-0x0000000000400000-0x0000000000457000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/2408-608-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2408-609-0x0000000002000000-0x0000000002008000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2584-397-0x00000000012A0000-0x0000000001550000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2584-398-0x00000000012A0000-0x0000000001550000-memory.dmp

                          Filesize

                          2.7MB

                          Download

                        • memory/2668-0-0x0000000000DE0000-0x00000000010F4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2668-1-0x0000000077760000-0x0000000077762000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2668-2-0x0000000000DE1000-0x0000000000E0F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2668-3-0x0000000000DE0000-0x00000000010F4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2668-4-0x0000000000DE0000-0x00000000010F4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2668-18-0x0000000000DE0000-0x00000000010F4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-24-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-185-0x0000000006A10000-0x0000000006EBC000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2696-131-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-132-0x0000000006A10000-0x0000000006EBC000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2696-112-0x0000000006A10000-0x0000000007686000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/2696-110-0x0000000006A10000-0x0000000007686000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/2696-94-0x0000000006A10000-0x0000000006E9B000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2696-93-0x0000000006A10000-0x0000000006E9B000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2696-92-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-685-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-86-0x0000000006A10000-0x0000000006E9B000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2696-520-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-684-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-87-0x0000000006A10000-0x0000000006E9B000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2696-69-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-68-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-48-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-683-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-682-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-166-0x0000000006A10000-0x0000000007686000-memory.dmp

                          Filesize

                          12.5MB

                          Download

                        • memory/2696-41-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-433-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-23-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-21-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-20-0x0000000000AA1000-0x0000000000ACF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2696-180-0x0000000006A10000-0x00000000070A5000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/2696-19-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-675-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-209-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-224-0x0000000006A10000-0x00000000070A5000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/2696-413-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-648-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2696-649-0x0000000000AA0000-0x0000000000DB4000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2812-664-0x000000001B780000-0x000000001BA62000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2812-665-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2840-165-0x00000000020C0000-0x00000000020C8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2840-164-0x000000001B6B0000-0x000000001B992000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2952-91-0x0000000000E60000-0x00000000012EB000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/2952-89-0x0000000000E60000-0x00000000012EB000-memory.dmp

                          Filesize

                          4.5MB

                          Download

                        • memory/3080-659-0x000000013FEE0000-0x0000000140370000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/3200-600-0x000000013F320000-0x000000013F7B0000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/3940-653-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-651-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-650-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-666-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-667-0x00000000000B0000-0x00000000000D0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3940-668-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-670-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-652-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-654-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-655-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-657-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download

                        • memory/3940-656-0x0000000140000000-0x0000000140770000-memory.dmp

                          Filesize

                          7.4MB

                          Download