Overview

overview

10

Static

static

3

b2f8caea1c...d4.exe

windows7-x64

10

b2f8caea1c...d4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2024, 03:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b2f8caea1c0425e7cf69d729262dfeede6df2a415803a7b497359f0124db3ad4.exe

  • Size

    2.8MB

  • MD5

    8487b3f80d4a1d6db6d0268b17b66b8b

  • SHA1

    16ebd2a072305b3432b0f1348c94e90899225e71

  • SHA256

    b2f8caea1c0425e7cf69d729262dfeede6df2a415803a7b497359f0124db3ad4

  • SHA512

    fa961e40f5c40dffbfc0eeec88eef0622acc0103191ec16c3b5a679464c0cb54f16d762918cec20db36b603752d563ad438305ccdf317e1fd4e1d18f085da451

  • SSDEEP

    49152:vjiYy8ijVHr78ghs32AITsqe52cGs2UFv3lwhCcmy:Le8ijVHv8ghs3z0bgFGsB1whC/y

Score
10/10
amadeycryptbotlummastealc9c9aa5stokdiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

cryptbot

C2

http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 28 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Identifies Wine through registry keys 2 TTPs 14 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2652
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3848
    • C:\Users\Admin\AppData\Local\Temp\b2f8caea1c0425e7cf69d729262dfeede6df2a415803a7b497359f0124db3ad4.exe
      "C:\Users\Admin\AppData\Local\Temp\b2f8caea1c0425e7cf69d729262dfeede6df2a415803a7b497359f0124db3ad4.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4280
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3432
        • C:\Users\Admin\AppData\Local\Temp\1017306001\6a14c8199c.exe
          "C:\Users\Admin\AppData\Local\Temp\1017306001\6a14c8199c.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4008
          • C:\Users\Admin\AppData\Local\Temp\1017306001\6a14c8199c.exe
            "C:\Users\Admin\AppData\Local\Temp\1017306001\6a14c8199c.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1516
        • C:\Users\Admin\AppData\Local\Temp\1017307001\e41e0a5b09.exe
          "C:\Users\Admin\AppData\Local\Temp\1017307001\e41e0a5b09.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:8
        • C:\Users\Admin\AppData\Local\Temp\1017308001\5110830a89.exe
          "C:\Users\Admin\AppData\Local\Temp\1017308001\5110830a89.exe"
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4364
        • C:\Users\Admin\AppData\Local\Temp\1017309001\539bca399f.exe
          "C:\Users\Admin\AppData\Local\Temp\1017309001\539bca399f.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:836
          • C:\Users\Admin\AppData\Local\Temp\1017309001\539bca399f.exe
            "C:\Users\Admin\AppData\Local\Temp\1017309001\539bca399f.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4636
        • C:\Users\Admin\AppData\Local\Temp\1017310001\4c6f1089ef.exe
          "C:\Users\Admin\AppData\Local\Temp\1017310001\4c6f1089ef.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:704
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath "C:\vnmpejhr"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2156
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:836
          • C:\vnmpejhr\6b1286ea1b6a4048b34c79636bb9d73f.exe
            "C:\vnmpejhr\6b1286ea1b6a4048b34c79636bb9d73f.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2316
        • C:\Users\Admin\AppData\Local\Temp\1017311001\8da6b8c60d.exe
          "C:\Users\Admin\AppData\Local\Temp\1017311001\8da6b8c60d.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3492
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 536
            4⤵
            • Program crash
            PID:4816
        • C:\Users\Admin\AppData\Local\Temp\1017312001\09e5eb3e6a.exe
          "C:\Users\Admin\AppData\Local\Temp\1017312001\09e5eb3e6a.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3128
          • C:\Users\Admin\AppData\Local\Temp\1017312001\09e5eb3e6a.exe
            "C:\Users\Admin\AppData\Local\Temp\1017312001\09e5eb3e6a.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1796
        • C:\Users\Admin\AppData\Local\Temp\1017313001\6bd1bab17d.exe
          "C:\Users\Admin\AppData\Local\Temp\1017313001\6bd1bab17d.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4824
        • C:\Users\Admin\AppData\Local\Temp\1017314001\5109184294.exe
          "C:\Users\Admin\AppData\Local\Temp\1017314001\5109184294.exe"
          3⤵
          • Enumerates VirtualBox registry keys
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2076
        • C:\Users\Admin\AppData\Local\Temp\1017315001\dbf77b1117.exe
          "C:\Users\Admin\AppData\Local\Temp\1017315001\dbf77b1117.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5080
          • C:\Users\Admin\AppData\Local\Temp\CE03EBLVJEJKGS323HBLBN8627PR.exe
            "C:\Users\Admin\AppData\Local\Temp\CE03EBLVJEJKGS323HBLBN8627PR.exe"
            4⤵
            • Modifies Windows Defender Real-time Protection settings
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Windows security modification
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3292
          • C:\Users\Admin\AppData\Local\Temp\1E9GK4AB1NJELUL9AATJO7HSPXSKU.exe
            "C:\Users\Admin\AppData\Local\Temp\1E9GK4AB1NJELUL9AATJO7HSPXSKU.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            PID:2348
        • C:\Users\Admin\AppData\Local\Temp\1017316001\fbc47016c8.exe
          "C:\Users\Admin\AppData\Local\Temp\1017316001\fbc47016c8.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          PID:3328
        • C:\Users\Admin\AppData\Local\Temp\1017317001\d166b4bfbe.exe
          "C:\Users\Admin\AppData\Local\Temp\1017317001\d166b4bfbe.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4112
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM firefox.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2196
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM chrome.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2908
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM msedge.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1344
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM opera.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:5040
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /F /IM brave.exe /T
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4768
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
            4⤵
              PID:3312
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                5⤵
                • Checks processor information in registry
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2724
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24d463ff-a1c8-430e-b3b3-3151114bafba} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" gpu
                  6⤵
                    PID:4680
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2420 -parentBuildID 20240401114208 -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {371b70c5-f61d-4eff-8cab-f6fdcbc70893} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" socket
                    6⤵
                      PID:3504
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2884 -childID 1 -isForBrowser -prefsHandle 3192 -prefMapHandle 3020 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbbd1195-4283-42f2-ada1-7cd6a0f04681} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab
                      6⤵
                        PID:4524
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -childID 2 -isForBrowser -prefsHandle 4156 -prefMapHandle 4152 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22be46a3-a08f-4358-a9ea-90655b302caa} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab
                        6⤵
                          PID:5008
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4944 -prefMapHandle 4908 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aab1c406-d2d6-4f36-a16a-598ca0cde77f} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" utility
                          6⤵
                          • Checks processor information in registry
                          PID:5596
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5076 -childID 3 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {03d63f5d-b370-4025-b84f-02b815d3b735} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab
                          6⤵
                            PID:5872
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5436 -childID 4 -isForBrowser -prefsHandle 5344 -prefMapHandle 5348 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9836b50d-9220-469d-959c-09e7f72d1913} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab
                            6⤵
                              PID:5888
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5456 -childID 5 -isForBrowser -prefsHandle 5548 -prefMapHandle 5552 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7f77522-70eb-4c92-8fdc-7bdd580c9e8e} 2724 "\\.\pipe\gecko-crash-server-pipe.2724" tab
                              6⤵
                                PID:5900
                        • C:\Users\Admin\AppData\Local\Temp\1017318001\976fadb21c.exe
                          "C:\Users\Admin\AppData\Local\Temp\1017318001\976fadb21c.exe"
                          3⤵
                          • Modifies Windows Defender Real-time Protection settings
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Windows security modification
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5032
                        • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                          "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:452
                          • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                            "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5540
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3492 -ip 3492
                      1⤵
                        PID:1852
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:5704
                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:5324

                      Network

                      MITRE ATT&CK Enterprise v15

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      1
                      T1543

                      Windows Service

                      1
                      T1543.003

                      Defense Evasion

                      Impair Defenses

                      2
                      T1562

                      Disable or Modify Tools

                      2
                      T1562.001

                      Modify Registry

                      3
                      T1112

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Credential Access

                      Credentials from Password Stores

                      1
                      T1555

                      Credentials from Web Browsers

                      1
                      T1555.003

                      Unsecured Credentials

                      3
                      T1552

                      Credentials In Files

                      3
                      T1552.001

                      Discovery

                      Browser Information Discovery

                      1
                      T1217

                      Query Registry

                      8
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Virtualization/Sandbox Evasion

                      3
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      3
                      T1005

                      Command and Control

                      Web Service

                      1
                      T1102

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                        Filesize

                        2KB

                        MD5

                        968cb9309758126772781b83adb8a28f

                        SHA1

                        8da30e71accf186b2ba11da1797cf67f8f78b47c

                        SHA256

                        92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                        SHA512

                        4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zudFSfy.exe.log
                        Filesize

                        1KB

                        MD5

                        8ec831f3e3a3f77e4a7b9cd32b48384c

                        SHA1

                        d83f09fd87c5bd86e045873c231c14836e76a05c

                        SHA256

                        7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

                        SHA512

                        26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        18KB

                        MD5

                        31501156ea7fd2c854c544636d14da30

                        SHA1

                        8e8bb90c9389b58c6e7287fa70483b62c0795277

                        SHA256

                        8959e1c73d9ddffc68b29616940ce27b8c591c160a369536bbfd10976566e98e

                        SHA512

                        d1fd00e2712afcdd4eaffe6eafb7cbd92356ef53fb4da39ef287db8ccadb03a6f43bf13e8e12b67e04ff48bfd4ef1e2fc2395f6435d30de019b6d112ea150749

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\activity-stream.discovery_stream.json
                        Filesize

                        27KB

                        MD5

                        a11b3d6dfd642845a7c2940d091af0e2

                        SHA1

                        493ab85d956baeedde080e90ce87cdd47ddf0bd0

                        SHA256

                        b18906ee2f1df10c6cc8540f66a9abf2c653ef74b1d37569396489c0fdbcd8f7

                        SHA512

                        3fbe69f68a5557c220551e8bc867b0ee2fa0cec8fca958986e37ff8b415a0bc040be024aee8bdeb6a0962bacb9ce171d86d9973c83163e97b7495128beeb8073

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984
                        Filesize

                        13KB

                        MD5

                        071a635167b2a5cb9023f86dd832dede

                        SHA1

                        74404558bed333a2567831867a9bdd9cc8d2c735

                        SHA256

                        8b5e0429cf83949f51d1c93ce309d2a0632247c30379bfed088c70ddba0a8f87

                        SHA512

                        fbc6a8bd9dfb753e0c4110e402a0cb246178517b563054c728685be861234633306814e7a651aca29e0e1f23c9f7b9785b7f2d1ecb909cec73f16a70c78673c1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\g9per00b.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017306001\6a14c8199c.exe
                        Filesize

                        3.1MB

                        MD5

                        c00a67d527ef38dc6f49d0ad7f13b393

                        SHA1

                        7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                        SHA256

                        12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                        SHA512

                        9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017307001\e41e0a5b09.exe
                        Filesize

                        1.8MB

                        MD5

                        ff279f4e5b1c6fbda804d2437c2dbdc8

                        SHA1

                        2feb3762c877a5ae3ca60eeebc37003ad0844245

                        SHA256

                        e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                        SHA512

                        c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017308001\5110830a89.exe
                        Filesize

                        4.3MB

                        MD5

                        32353fd729d2709ff0f7fbd5af5d38b1

                        SHA1

                        bd2666a194111152ed802d4c5ae96f5ecc6f61c3

                        SHA256

                        506a9cff027877d2344079b59c90ed5cd5f85225ede2828ce2a9aaf0c22cd329

                        SHA512

                        09f8cf2c288453d75d0ef19065f62791bbdd7a5fe1f91294db23025b9f394f9edcaae3c4451b2ce6807f0bdd9b39a977a5905a6aa44b9ba6ab39b162486839b7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017309001\539bca399f.exe
                        Filesize

                        758KB

                        MD5

                        afd936e441bf5cbdb858e96833cc6ed3

                        SHA1

                        3491edd8c7caf9ae169e21fb58bccd29d95aefef

                        SHA256

                        c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                        SHA512

                        928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017310001\4c6f1089ef.exe
                        Filesize

                        21KB

                        MD5

                        14becdf1e2402e9aa6c2be0e6167041e

                        SHA1

                        72cbbae6878f5e06060a0038b25ede93b445f0df

                        SHA256

                        7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                        SHA512

                        16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017311001\8da6b8c60d.exe
                        Filesize

                        1.9MB

                        MD5

                        eed0b74ba5f52789a7b50fbf64a6eb5f

                        SHA1

                        146367bafe9364ec489c48dbee6b8b8aeecf38fc

                        SHA256

                        e3d09adecc926177201dc5ec6b6a3ba661b8de3aed15afa65893e3ad76303c61

                        SHA512

                        e9bd7a33f7da4b87aa0f18f33b3b54fe3cf8c4436e88d1d39405608a62dc8d69d516dde7bb5211b9b4396c2198ed42c447b7c4a627eed892bfc0d468ddf92d3f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017312001\09e5eb3e6a.exe
                        Filesize

                        747KB

                        MD5

                        8a9cb17c0224a01bd34b46495983c50a

                        SHA1

                        00296ea6a56f6e10a0f1450a20c5fb329b8856c1

                        SHA256

                        3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

                        SHA512

                        1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017313001\6bd1bab17d.exe
                        Filesize

                        1.8MB

                        MD5

                        25fb9c54265bbacc7a055174479f0b70

                        SHA1

                        4af069a2ec874703a7e29023d23a1ada491b584e

                        SHA256

                        552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                        SHA512

                        7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017314001\5109184294.exe
                        Filesize

                        4.2MB

                        MD5

                        fa2b9ef3eedea37bee3f07f9a580ca57

                        SHA1

                        886267a5d0287a9e8385aa7337f7c0dfb6e0c3b2

                        SHA256

                        bb2af2fb0383047e427ce40b100535426c1037778a3e3c713158d02d6ab6c8a2

                        SHA512

                        a5ffb97936a0c9b4451436b9b8d5e433a108ad5c9c70c9bce55e8597e7b76e9d8d0786663f9e535bb313a51a1ed75a482c08dba6ec64eafe46029905ad406f64

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017315001\dbf77b1117.exe
                        Filesize

                        1.7MB

                        MD5

                        81cfbdcd567c50d28a6380910dd6cf83

                        SHA1

                        3fac13a3e2416853ce16ed6052ba91e4ec978c86

                        SHA256

                        55cb3e812b8545ae08027c08bc3d8d0ffc8e6cd2854547a582ab3c4e2db88d1d

                        SHA512

                        fd083c0ec0a95175ef05afb2c60cc1990b868d0a5db483372a294bda2955db7dbe586ab9c3633a7bbb2bfc6f478e09b2f5e04fae41393a626dbb53345fc81838

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017316001\fbc47016c8.exe
                        Filesize

                        2.7MB

                        MD5

                        b02d86ff1695f8c3faf80f6e5cd1b8bf

                        SHA1

                        aaf7bc27106152a25b5ad8ce4c643f4def00bfe8

                        SHA256

                        ff283c5f3e854c82dcfb4ea631f5f68496fb1654d025b5f3acfae5318c5ed088

                        SHA512

                        4c219352d2555f183b143ec875f7944c622d1f5fdd5969caf46844e537fd8852c0309e9d9d0cadc55e151bda2cc49eff2d8bb2d84e81ce5261f2e0f474fc7098

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017317001\d166b4bfbe.exe
                        Filesize

                        945KB

                        MD5

                        457285e2cf3c306e05a2dc450c9748ad

                        SHA1

                        d9d57583b4eac7332c9ff79869695b995ba44d2f

                        SHA256

                        0c9c4c41cda2b02f17a65d180643a428c70c4535d0e214739c3d461403408f06

                        SHA512

                        f4c5f17aa2e388e4f682869999ca7ff10c79cd2a66e2803c630c75a2748399201805ac7bf0a352132bd8f9ae06420a51a2c5a003a5b4d1a011ddbc12ee728003

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
                        Filesize

                        1.1MB

                        MD5

                        ef08a45833a7d881c90ded1952f96cb4

                        SHA1

                        f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                        SHA256

                        33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                        SHA512

                        74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\CE03EBLVJEJKGS323HBLBN8627PR.exe
                        Filesize

                        1.7MB

                        MD5

                        51501deb706a509a1dec7745ecf713e3

                        SHA1

                        7a925e2f3231498ab0cbd8cefe9b475fbab5f58b

                        SHA256

                        fe72e6a8775634e7d76adecf570a2866a81714d3e3d7be6174c8fefb327f2f0b

                        SHA512

                        cae65b34492e2c8413bcc19448697bd8c76e685046b60ecc65b313a49e4d7f9e9df24f0593f4691cffca1d8c7e9bc077bb2df7918767614b2172167bdc847476

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tmrcea00.4pj.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                        Filesize

                        2.8MB

                        MD5

                        8487b3f80d4a1d6db6d0268b17b66b8b

                        SHA1

                        16ebd2a072305b3432b0f1348c94e90899225e71

                        SHA256

                        b2f8caea1c0425e7cf69d729262dfeede6df2a415803a7b497359f0124db3ad4

                        SHA512

                        fa961e40f5c40dffbfc0eeec88eef0622acc0103191ec16c3b5a679464c0cb54f16d762918cec20db36b603752d563ad438305ccdf317e1fd4e1d18f085da451

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        Filesize

                        479KB

                        MD5

                        09372174e83dbbf696ee732fd2e875bb

                        SHA1

                        ba360186ba650a769f9303f48b7200fb5eaccee1

                        SHA256

                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                        SHA512

                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                        Filesize

                        13.8MB

                        MD5

                        0a8747a2ac9ac08ae9508f36c6d75692

                        SHA1

                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                        SHA256

                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                        SHA512

                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                        Filesize

                        6KB

                        MD5

                        13eb50618fa8e0196bf8755e67182f2f

                        SHA1

                        abe8731cc6073874dd7c6c4619e7e16e424d015b

                        SHA256

                        fe7174862c4f42bf8b0086b49334b2f2f2c114aa384d8263847a47f1b4f8cf58

                        SHA512

                        db207bbb1343a8f4e50763211a55276ee7729ad7dba01aa3fe7dea15d484a007cb519991d5ea4b70e397a59a7227f3dca3b88e7a428eb083964800667b51be89

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\AlternateServices.bin
                        Filesize

                        10KB

                        MD5

                        03759c1f9718d718ae693eb73fe3cb54

                        SHA1

                        0e3ea908621a1614ef0979abba3de2ddeaf81a0d

                        SHA256

                        1e7006f16e179366559f7af9f8b66f06be6307b8d9a77cc670afb6fa79cd64cd

                        SHA512

                        1991c78253a5805bec3b7d5f727a7b25c98b173cbf3b7dfd58e3df046902166a9faf77e5bae444bf44b2200fe9a849556e6fde5e0c53fa708542c25f5b87e2a0

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        21KB

                        MD5

                        f7f3894c057ef7370da1e835438c426a

                        SHA1

                        6384e175dfaaa3b76a6c16ca0c7b1fbd3b68b9ce

                        SHA256

                        a322a26c84337eaa8c04322dded81ecb69b7c308899e9dab99638b1cbba6fcd5

                        SHA512

                        1d1733241ba71a511b6c179fffcf574260c48c498cae947ebe239240c4459dffac7c1dc8beec797208618a79afcddfbc9ecc41da02b567317794a2f87418e4b9

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        25KB

                        MD5

                        faecdbd0f2a9a98e9c6d5381c57cdf6a

                        SHA1

                        f4e4c47b1f997ea79b8dcc2e53f06eeb843b692b

                        SHA256

                        98c946fa7026ca22df76225a1cf5f1bbbf3ac4e70b3b1638ee4dedaf97e6610b

                        SHA512

                        884e6a6a71747cf1f52995b1f8dfa76aa0026792e189ed285a183bf16805978b482f3953e79a461580d4df55d46451eab30693ea99445a665a3fab6007b58e1f

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        25KB

                        MD5

                        cfffdce9dfa7f4243900abb020c6ef01

                        SHA1

                        b86a9a83b250d53eaea09c7cbe016e361f9c76ee

                        SHA256

                        f3537df9b714e126bc93014ae4897f3e14426596219e7ef419aac4820ecc30cf

                        SHA512

                        0ac5ae8e665e0fa555f0a6693c6332baed2432f678e4552bfa8c77325ed9d42efc97192043cc25a53ebd3a35a1027e5e62c605a13f1c49a69e0e3b5b58e0aa5e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        22KB

                        MD5

                        67538dff70058b9fc65507c12f3a0d8e

                        SHA1

                        52c339f030bbbd48079b92015ae05d5c5eecf72a

                        SHA256

                        c02c46c3457984c362f7a75b62b6a91199726a6bd993376291910f89984b0129

                        SHA512

                        d3c3725241722e39a6ee9ed250f4503c51654c8c940bdbfcb3df1c655b313e0a7ac07403771cf96dfc6471d71c3c84ee714f08c9df426e6786c8ee807f2425d4

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\db\data.safe.tmp
                        Filesize

                        22KB

                        MD5

                        9d0ff9ac3228e3573802d72ccd5fa2a6

                        SHA1

                        257bbd30b9e2a0811a519f215777f696b69c8c88

                        SHA256

                        887e45f0bc911f782b88f670702a7db6c2b73b587c115cbfa3f0377265dacbcf

                        SHA512

                        bfbdf7cc0be7e1b3e4edc3defd510e2a41c250e2fd4127d6e46cc8206d29809cb831d59eb8720c73588fb04d8d743715df6ec6812706359029a8214f6d337472

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\e2b928e0-967f-4bc1-b67c-a95408f35cd1
                        Filesize

                        659B

                        MD5

                        267627892d73794038cad6b1d969e382

                        SHA1

                        f498039a172aa67839996ea8a14450c12a510d09

                        SHA256

                        f0b3378a42e7cf3bfc3045fa919c2335a82ecb439ceb7f9fdf4420855e472dbd

                        SHA512

                        212f940588c03260235b8e6476dc9bfd5520841e415ce8e70245e9474e0249e65bfe339eb224e41d21b9af7cc9ce77259076a823345cacbbea732f0199b0f11a

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\datareporting\glean\pending_pings\e4972639-0c55-411d-b594-94687bae180b
                        Filesize

                        982B

                        MD5

                        91cc8f8b6c47a58bf51b3c0fbc86fe24

                        SHA1

                        4f925f6e6ff2bf69ed77b6ff791027d1ccb230e9

                        SHA256

                        451bbce8a64c3017ee7e97d7bbe9d8a14732e3b3db9d3b284c45b68842446175

                        SHA512

                        27b6d1337b22687d34b83b1615971e9e92010eb50fee0d907dc8b8138d5cd2a5d8b4fab7e4045af8268c936ad17084f86a604d42f3524afc2db57f4f7c0ba731

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                        Filesize

                        1.1MB

                        MD5

                        842039753bf41fa5e11b3a1383061a87

                        SHA1

                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                        SHA256

                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                        SHA512

                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                        Filesize

                        116B

                        MD5

                        2a461e9eb87fd1955cea740a3444ee7a

                        SHA1

                        b10755914c713f5a4677494dbe8a686ed458c3c5

                        SHA256

                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                        SHA512

                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                        Filesize

                        372B

                        MD5

                        bf957ad58b55f64219ab3f793e374316

                        SHA1

                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                        SHA256

                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                        SHA512

                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                        Filesize

                        17.8MB

                        MD5

                        daf7ef3acccab478aaa7d6dc1c60f865

                        SHA1

                        f8246162b97ce4a945feced27b6ea114366ff2ad

                        SHA256

                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                        SHA512

                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                        Filesize

                        10KB

                        MD5

                        76c2314df4ed2fe8139a12b76cc4154a

                        SHA1

                        c52e8d96d2828f48fc24e29fd8e6e8fe656aed1c

                        SHA256

                        5ae2969a25d71ac5a5098b462c54dda38edcf94dec7969ec23a6bba6be08df96

                        SHA512

                        bddbd7d440d17c21835f29e88eecfdaaabc6dd169a92603db1f5e107d4f820e7fce492487166e14cdd4d00deca5aa34e63c676633605da38d1fe9555c42754c5

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                        Filesize

                        12KB

                        MD5

                        814bcbb915f81bd08ccc6ae913cb177e

                        SHA1

                        8a2a46f07d656dee28a6c59420753eeec9941e6a

                        SHA256

                        460415c6f2c891fcd16a806dca324062c0e18712c03b07689895ca5308e3b225

                        SHA512

                        48087326c0a2a23dc25e9297a41129ff577ffb61701c7315fcf820926f0db987941fa494a5433f5017b7f8c01a650d8a3b3b1ec801d7679a4ac66e4add2a7425

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs-1.js
                        Filesize

                        15KB

                        MD5

                        c158b6772afabbd4782c7efa2d7a724a

                        SHA1

                        955f1317b81808d672eb4e6dd2b8212d47c56a0f

                        SHA256

                        e0d58551bb1f6589f842174b688ddd26acf0ac9323aa652e689d5d7994cc2045

                        SHA512

                        39165777eb4d750b4881bd7b9c7eeeb906eb6435ae837d40a8c7ce006a25a7dd631c6a206d4b71bc67a97ba3ba51b7dcf45005ec7eb94ac088573d2348cf4046

                        Download Submit

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\prefs.js
                        Filesize

                        10KB

                        MD5

                        c8d02c8eed1c402895e9883153666dfe

                        SHA1

                        9a1cae86bad7e0064d344594695e218c929bf8b7

                        SHA256

                        01b23a5dc4554ea1b2bcf8b3a01b6ac171f43c4342d1f90cdaeb40e0b06a563d

                        SHA512

                        65da3905a9698797f6117169d1a7e6e78c0e58b4b8697e61ed3b79bbcdc3afd47278259040a82bd9822cf51425dccf49c45d4b53fa9cfbdfde5f1610696ef865

                        Download Submit

                      • C:\vnmpejhr\6b1286ea1b6a4048b34c79636bb9d73f.exe
                        Filesize

                        1.2MB

                        MD5

                        577cd52217da6d7163cea46bb01c107f

                        SHA1

                        82b31cc52c538238e63bdfc22d1ea306ea0b852a

                        SHA256

                        139762e396fb930400fab8faab80cb679abbe642144261cba24973fb23bcd728

                        SHA512

                        8abad4eaf2a302dfd9ead058e8c14d996437975730125c46d034a71028921ff36ff5d157ad3671e328ac667ec8095db19fa14a9e8eaaf1a7738aa3d0120b5474

                        Download Submit

                      • memory/8-100-0x00000000005E0000-0x0000000000A86000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/8-62-0x00000000005E0000-0x0000000000A86000-memory.dmp

                        Filesize

                        4.6MB

                        Download

                      • memory/452-799-0x0000000005910000-0x00000000059D2000-memory.dmp

                        Filesize

                        776KB

                        Download

                      • memory/452-767-0x0000000004DF0000-0x0000000004E16000-memory.dmp

                        Filesize

                        152KB

                        Download

                      • memory/452-754-0x0000000007A60000-0x0000000007A6A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/452-752-0x00000000079A0000-0x0000000007A32000-memory.dmp

                        Filesize

                        584KB

                        Download

                      • memory/452-744-0x0000000000B20000-0x0000000000C36000-memory.dmp

                        Filesize

                        1.1MB

                        Download

                      • memory/704-119-0x0000000000970000-0x000000000097C000-memory.dmp

                        Filesize

                        48KB

                        Download

                      • memory/836-228-0x000000006F840000-0x000000006F88C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/836-240-0x0000000007E10000-0x0000000007E24000-memory.dmp

                        Filesize

                        80KB

                        Download

                      • memory/836-239-0x0000000007DD0000-0x0000000007DE1000-memory.dmp

                        Filesize

                        68KB

                        Download

                      • memory/836-238-0x0000000007B00000-0x0000000007BA3000-memory.dmp

                        Filesize

                        652KB

                        Download

                      • memory/836-212-0x0000000006040000-0x0000000006394000-memory.dmp

                        Filesize

                        3.3MB

                        Download

                      • memory/1516-290-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/1516-288-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/1796-225-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/1796-223-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                        Download

                      • memory/2076-284-0x00000000007B0000-0x0000000001306000-memory.dmp

                        Filesize

                        11.3MB

                        Download

                      • memory/2076-334-0x00000000007B0000-0x0000000001306000-memory.dmp

                        Filesize

                        11.3MB

                        Download

                      • memory/2076-371-0x00000000007B0000-0x0000000001306000-memory.dmp

                        Filesize

                        11.3MB

                        Download

                      • memory/2076-335-0x00000000007B0000-0x0000000001306000-memory.dmp

                        Filesize

                        11.3MB

                        Download

                      • memory/2156-158-0x0000000007010000-0x0000000007042000-memory.dmp

                        Filesize

                        200KB

                        Download

                      • memory/2156-125-0x0000000005990000-0x00000000059F6000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/2156-189-0x0000000007570000-0x0000000007581000-memory.dmp

                        Filesize

                        68KB

                        Download

                      • memory/2156-199-0x00000000075B0000-0x00000000075C4000-memory.dmp

                        Filesize

                        80KB

                        Download

                      • memory/2156-200-0x00000000076B0000-0x00000000076CA000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/2156-203-0x0000000007690000-0x0000000007698000-memory.dmp

                        Filesize

                        32KB

                        Download

                      • memory/2156-121-0x0000000004A50000-0x0000000004A86000-memory.dmp

                        Filesize

                        216KB

                        Download

                      • memory/2156-122-0x00000000050C0000-0x00000000056E8000-memory.dmp

                        Filesize

                        6.2MB

                        Download

                      • memory/2156-186-0x00000000075F0000-0x0000000007686000-memory.dmp

                        Filesize

                        600KB

                        Download

                      • memory/2156-180-0x00000000079B0000-0x000000000802A000-memory.dmp

                        Filesize

                        6.5MB

                        Download

                      • memory/2156-181-0x0000000007370000-0x000000000738A000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/2156-123-0x0000000005030000-0x0000000005052000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/2156-185-0x00000000073E0000-0x00000000073EA000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/2156-124-0x0000000005920000-0x0000000005986000-memory.dmp

                        Filesize

                        408KB

                        Download

                      • memory/2156-190-0x00000000075A0000-0x00000000075AE000-memory.dmp

                        Filesize

                        56KB

                        Download

                      • memory/2156-135-0x0000000005B40000-0x0000000005E94000-memory.dmp

                        Filesize

                        3.3MB

                        Download

                      • memory/2156-136-0x0000000006040000-0x000000000605E000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/2156-145-0x0000000006090000-0x00000000060DC000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/2156-159-0x000000006F840000-0x000000006F88C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/2156-170-0x0000000006610000-0x000000000662E000-memory.dmp

                        Filesize

                        120KB

                        Download

                      • memory/2156-171-0x0000000007250000-0x00000000072F3000-memory.dmp

                        Filesize

                        652KB

                        Download

                      • memory/2316-312-0x0000000000670000-0x0000000000A2B000-memory.dmp

                        Filesize

                        3.7MB

                        Download

                      • memory/2316-267-0x0000000000670000-0x0000000000A2B000-memory.dmp

                        Filesize

                        3.7MB

                        Download

                      • memory/2348-393-0x0000000000610000-0x0000000000AFC000-memory.dmp

                        Filesize

                        4.9MB

                        Download

                      • memory/2348-369-0x0000000000610000-0x0000000000AFC000-memory.dmp

                        Filesize

                        4.9MB

                        Download

                      • memory/3292-361-0x0000000000400000-0x0000000000868000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/3292-360-0x0000000000400000-0x0000000000868000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/3292-358-0x0000000000400000-0x0000000000868000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/3292-775-0x0000000000400000-0x0000000000868000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/3292-786-0x0000000000400000-0x0000000000868000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/3328-333-0x0000000000250000-0x000000000073C000-memory.dmp

                        Filesize

                        4.9MB

                        Download

                      • memory/3328-330-0x0000000000250000-0x000000000073C000-memory.dmp

                        Filesize

                        4.9MB

                        Download

                      • memory/3432-310-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-21-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-787-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-63-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-46-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-800-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-256-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-120-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-43-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-22-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-20-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-390-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-18-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/3432-19-0x0000000000E51000-0x0000000000E7F000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/3492-176-0x0000000075AC0000-0x0000000075CD5000-memory.dmp

                        Filesize

                        2.1MB

                        Download

                      • memory/3492-172-0x0000000004F10000-0x0000000005310000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/3492-188-0x00000000006C0000-0x0000000000B86000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/3492-156-0x00000000006C0000-0x0000000000B86000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/3492-173-0x0000000004F10000-0x0000000005310000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/3492-174-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                        Filesize

                        2.0MB

                        Download

                      • memory/3848-177-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/3848-179-0x0000000001560000-0x0000000001960000-memory.dmp

                        Filesize

                        4.0MB

                        Download

                      • memory/3848-182-0x00007FFE8BC30000-0x00007FFE8BE25000-memory.dmp

                        Filesize

                        2.0MB

                        Download

                      • memory/3848-184-0x0000000075AC0000-0x0000000075CD5000-memory.dmp

                        Filesize

                        2.1MB

                        Download

                      • memory/4008-285-0x0000000005750000-0x00000000058A6000-memory.dmp

                        Filesize

                        1.3MB

                        Download

                      • memory/4008-79-0x000000007363E000-0x000000007363F000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4008-292-0x0000000073630000-0x0000000073DE0000-memory.dmp

                        Filesize

                        7.7MB

                        Download

                      • memory/4008-287-0x0000000005330000-0x0000000005352000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/4008-286-0x0000000005E50000-0x00000000063F4000-memory.dmp

                        Filesize

                        5.6MB

                        Download

                      • memory/4008-41-0x000000007363E000-0x000000007363F000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4008-45-0x0000000073630000-0x0000000073DE0000-memory.dmp

                        Filesize

                        7.7MB

                        Download

                      • memory/4008-42-0x00000000006D0000-0x00000000009F8000-memory.dmp

                        Filesize

                        3.2MB

                        Download

                      • memory/4008-81-0x0000000073630000-0x0000000073DE0000-memory.dmp

                        Filesize

                        7.7MB

                        Download

                      • memory/4008-44-0x00000000054B0000-0x000000000554C000-memory.dmp

                        Filesize

                        624KB

                        Download

                      • memory/4280-4-0x0000000000190000-0x00000000004A5000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/4280-17-0x0000000000190000-0x00000000004A5000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/4280-0-0x0000000000190000-0x00000000004A5000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/4280-3-0x0000000000190000-0x00000000004A5000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/4280-2-0x0000000000191000-0x00000000001BF000-memory.dmp

                        Filesize

                        184KB

                        Download

                      • memory/4280-1-0x0000000077A24000-0x0000000077A26000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/4364-80-0x0000000000820000-0x0000000001415000-memory.dmp

                        Filesize

                        12.0MB

                        Download

                      • memory/4364-227-0x0000000000820000-0x0000000001415000-memory.dmp

                        Filesize

                        12.0MB

                        Download

                      • memory/4364-169-0x0000000000820000-0x0000000001415000-memory.dmp

                        Filesize

                        12.0MB

                        Download

                      • memory/4364-157-0x0000000000820000-0x0000000001415000-memory.dmp

                        Filesize

                        12.0MB

                        Download

                      • memory/4636-97-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/4636-99-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download

                      • memory/4824-258-0x0000000000050000-0x00000000004FB000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4824-315-0x0000000000050000-0x00000000004FB000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4824-313-0x0000000000050000-0x00000000004FB000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/4824-308-0x0000000000050000-0x00000000004FB000-memory.dmp

                        Filesize

                        4.7MB

                        Download

                      • memory/5032-391-0x0000000000710000-0x0000000000B78000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/5032-395-0x0000000000710000-0x0000000000B78000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/5032-394-0x0000000000710000-0x0000000000B78000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/5032-792-0x0000000000710000-0x0000000000B78000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/5032-788-0x0000000000710000-0x0000000000B78000-memory.dmp

                        Filesize

                        4.4MB

                        Download

                      • memory/5080-368-0x0000000000030000-0x00000000004B6000-memory.dmp

                        Filesize

                        4.5MB

                        Download

                      • memory/5080-309-0x0000000000030000-0x00000000004B6000-memory.dmp

                        Filesize

                        4.5MB

                        Download

                      • memory/5080-357-0x0000000000030000-0x00000000004B6000-memory.dmp

                        Filesize

                        4.5MB

                        Download

                      • memory/5324-5076-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/5324-5078-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/5540-965-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-953-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-967-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-971-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-963-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-961-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-959-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-957-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-955-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-969-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-951-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-949-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-947-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-946-0x0000000005230000-0x00000000052C1000-memory.dmp

                        Filesize

                        580KB

                        Download

                      • memory/5540-3090-0x0000000005330000-0x000000000535C000-memory.dmp

                        Filesize

                        176KB

                        Download

                      • memory/5540-3091-0x00000000053C0000-0x000000000540C000-memory.dmp

                        Filesize

                        304KB

                        Download

                      • memory/5540-936-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                        Download

                      • memory/5540-945-0x0000000005230000-0x00000000052C8000-memory.dmp

                        Filesize

                        608KB

                        Download

                      • memory/5704-776-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download

                      • memory/5704-777-0x0000000000E50000-0x0000000001165000-memory.dmp

                        Filesize

                        3.1MB

                        Download