snakekeylogger | 2530ca42857b5d025729fb7736ab224b407ffdbe7039a6c962f1f6e3b706b3d8

Resubmissions

07-02-2025 10:23

250207-mes96syqcn 10

06-02-2025 21:29

250206-1b9pmsxmh1 10

Analysis

max time kernel
28s
max time network
30s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250128-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
07-02-2025 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2530ca42857b5d025729fb7736ab224b407ffdbe7039a6c962f1f6e3b706b3d8.exe
Size

826KB
MD5

b3b46efad9dac8cd52ffc04fd149f805
SHA1

421f5c82cce3af81ebe1381817c03a5554837a6f
SHA256

2530ca42857b5d025729fb7736ab224b407ffdbe7039a6c962f1f6e3b706b3d8
SHA512

7626f6f5eaca0491c156046f80c92e69d303ef6a2a9460bd3e37158e491556dc88698e52b26696f5d7e33cff722f23be938a195e2f868b26a79cc03a8cc6ff36
SSDEEP

12288:ULkUMXe5y/t1u9OF8IKLMwAL/6HEuwPtqGMyRQCbZ1uhPH7bUk6x:ULm8IKLMx72E9qbCbZ1U7bU3x

Score

10^/10

snakekeylogger collection discovery keylogger stealer

Malware Config

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7817497413:AAH6fX2oZGM3XzbbIU69SVEGO80t6mDhjdU/sendMessage?chat_id=1695799026

Signatures

Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral1/memory/2336-298-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
70	reallyfreegeoip.org
66	checkip.dyndns.org
68	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4512 set thread context of 2336	4512	2530ca42857b5d025729fb7736ab224b407ffdbe7039a6c962f1f6e3b706b3d8.exe	103

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2530ca42857b5d025729fb7736ab224b407ffdbe7039a6c962f1f6e3b706b3d8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2336	RegSvcs.exe
2336	RegSvcs.exe
2336	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	firefox.exe
Token: SeDebugPrivilege	1724	firefox.exe
Token: SeDebugPrivilege	2336	RegSvcs.exe
Token: SeDebugPrivilege	4024	firefox.exe
Token: SeDebugPrivilege	4024	firefox.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
1724	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe
4024	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1724	firefox.exe
4024	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 820 wrote to memory of 1724	820	firefox.exe	92
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3592	1724	firefox.exe	93
PID 1724 wrote to memory of 3988	1724	firefox.exe	94
PID 1724 wrote to memory of 3988	1724	firefox.exe	94
PID 1724 wrote to memory of 3988	1724	firefox.exe	94
PID 1724 wrote to memory of 3988	1724	firefox.exe	94
PID 1724 wrote to memory of 3988	1724	firefox.exe	94
PID 1724 wrote to memory of 3988	1724	firefox.exe	94
PID 1724 wrote to memory of 3988	1724	firefox.exe	94
PID 1724 wrote to memory of 3988	1724	firefox.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-849517464-2021344836-54366720-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\2530ca42857b5d025729fb7736ab224b407ffdbe7039a6c962f1f6e3b706b3d8.exe
"C:\Users\Admin\AppData\Local\Temp\2530ca42857b5d025729fb7736ab224b407ffdbe7039a6c962f1f6e3b706b3d8.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2336

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1932 -prefMapHandle 1924 -prefsLen 27199 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56444cb7-8fcd-4662-8dc5-3eae5801b521} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" gpu
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2332 -prefMapHandle 2336 -prefsLen 27077 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78ac5679-5a5f-4717-9148-911052bd2616} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" socket
    3⤵
    PID:3988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 1 -isForBrowser -prefsHandle 3160 -prefMapHandle 3172 -prefsLen 27218 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1792fed-4558-4de3-9619-436bbe792671} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" tab
    3⤵
    PID:336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3736 -childID 2 -isForBrowser -prefsHandle 3720 -prefMapHandle 2420 -prefsLen 32451 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5f7e6f63-31b3-4da4-89bd-44deeb13880f} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" tab
    3⤵
    PID:1284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5016 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5012 -prefMapHandle 5008 -prefsLen 32451 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {85b2fbf1-d843-4a61-89a3-8212618056cc} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" utility
    3⤵
    - Checks processor information in registry
    PID:2348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5336 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e1129e7-aab1-4b6d-81a4-cb8783d72702} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" tab
    3⤵
    PID:3588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5584 -childID 4 -isForBrowser -prefsHandle 5504 -prefMapHandle 5508 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {094a1484-85b2-4f22-8398-b8c41928dc13} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" tab
    3⤵
    PID:4028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -childID 5 -isForBrowser -prefsHandle 5704 -prefMapHandle 5712 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0b5cf2e-3bc5-44b7-a94e-1cd8956c37a9} 1724 "\\.\pipe\gecko-crash-server-pipe.1724" tab
    3⤵
    PID:4368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1920
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1872 -prefsLen 27268 -prefMapSize 244710 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bcb7160-4708-40d7-99ca-25ea956a7ba0} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" gpu
    3⤵
    PID:4552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2372 -parentBuildID 20240401114208 -prefsHandle 2348 -prefMapHandle 2336 -prefsLen 27146 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c06469fb-6443-4a52-9ecb-c965f7bb8fef} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" socket
    3⤵
    PID:4100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2548 -childID 1 -isForBrowser -prefsHandle 3184 -prefMapHandle 3272 -prefsLen 22698 -prefMapSize 244710 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {565bb531-1e69-4b3b-b863-ff49ecd704a4} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" tab
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4168 -childID 2 -isForBrowser -prefsHandle 4152 -prefMapHandle 4160 -prefsLen 32517 -prefMapSize 244710 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cbf13cd-4ba0-4af3-a0b6-bf380d01c6a4} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" tab
    3⤵
    PID:964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4724 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4720 -prefMapHandle 4764 -prefsLen 32517 -prefMapSize 244710 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc54a631-829d-48a7-87a7-4148ad9404b8} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" utility
    3⤵
    - Checks processor information in registry
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5060 -childID 3 -isForBrowser -prefsHandle 5052 -prefMapHandle 5016 -prefsLen 27044 -prefMapSize 244710 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4dc9a05d-bd24-4676-92c3-08f30f967fea} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" tab
    3⤵
    PID:5660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5168 -childID 4 -isForBrowser -prefsHandle 5176 -prefMapHandle 5076 -prefsLen 27044 -prefMapSize 244710 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {473905fc-5e7d-4694-be02-e53feaec5ba0} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" tab
    3⤵
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5276 -childID 5 -isForBrowser -prefsHandle 5472 -prefMapHandle 5468 -prefsLen 27044 -prefMapSize 244710 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e8fe8c7-2646-475c-9ef2-6b1398020eb8} 4024 "\\.\pipe\gecko-crash-server-pipe.4024" tab
    3⤵
    PID:5728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\activity-stream.discovery_stream.json

Filesize
25KB

MD5
84b51007745220da6d96a595348a6b71

SHA1
298ca35b10897766cf524ebae109f9e8ca7f875c

SHA256
68253f8e9ee3c67764e3582273b264decee23f50deca650dc53982a08e6057cf

SHA512
31ac0474df76b73f2b1e6fb4272cce15819009d979f5334fa43184300a47dc6c1d54b3eb265fcc6d459af94db0e13858e4224ece0aa9ae76c0518acdd8bcbfbc

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

Filesize
9KB

MD5
511506a0c25ad14c3cfdb7dd5a08afb7

SHA1
61397c5512218c14fcafad3854df7e522d12efe6

SHA256
43a1723eb91cc99484667c711650eaa79dea63117740a9b83fb0893a62c5ca78

SHA512
8aa06f2210d0cf3a8d227f861899e31faa24eefcfecf696179904580a607ee08f199ca52eb535b589788adeccb4dbed90255401fe17057569b556cbd607932d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

Filesize
13KB

MD5
a18b96b87eb2fb583bf2a42573e33044

SHA1
b0ed1e52155cc0d753a2066ec30dee7306c0e8d6

SHA256
573553794c46f1862421c7415714e8bf01e1cbd1c0c9808dd41dffd904291539

SHA512
1fe6cc2cafdcb77387b4397052e56a72f0f7a1424ca1f1633726363c42e34773244b0d49e79322b5defb9b6eebb99ce8ca27fe35fc8a9b30c864e63221c49508

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

Filesize
133KB

MD5
41e25a83720db7399d6022ee9a97bb37

SHA1
aee392d4174c9ebba1dcd9a730ffa61fb2a452aa

SHA256
2c050f54dc24c7bb8eaef4868ab207bd6957bc7ab6e32b7f8e461741a3dd9670

SHA512
52c07b781a90a7399f744738f19f2fb273925096c9fd02688ec339b8c4b0266a59bfad48fb3b04838b68806b2bd04fe765928dbb75f034a67c83844fa363df6c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\cache2\entries\D18FB7DA89F8DD4E7A2C97703A1647E8C981D05A

Filesize
13KB

MD5
29e9999d9e04b8df4dadc43569d8940c

SHA1
f98d58004bc2205a601c12e9282eab1ed56bd13e

SHA256
8c8b06ee7d8dd3c004a46298aaba4b674b37072d7e150e9466e4dced574f1893

SHA512
da22aa3e014275baf3985356ea56a05fc7b18324570452e6af710b72f82e6d44bb159b32dd358f61fd2d256c4c087083da08f396cc5f69051cdd1394e89bba62

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\startupCache\scriptCache.bin

Filesize
8.6MB

MD5
19d4d259ee2e6f02d8fc1c850f5a3dac

SHA1
80983c839908d705284a5908d1cd6033d851589a

SHA256
1668be8c8a39e17248a84803126b4bacbd879850d175236239524dc9e598c067

SHA512
e5d6a57fde2d92aa90f7812080d0d10b4a5b76044befb8c7ad43eb26c018951959417ee6888aa7b68da9944fcfc7b3b2b8ebc52aa287929bb66f13c010271ef0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
57dd1b4f35850bebcb329645e7cba69f

SHA1
b59add2f828938b55661734769a9c2f665e468d9

SHA256
be136f07267fb97a210e96eb7e7b8d0f6a6e991ea697d08cee4b32685d591800

SHA512
3f3410ea5d1eb6d6cc08ea2f654c5ce8e9da76c155bf3ebfd2f8205aa6e8e3449591c2e943234400f51f75148df5dd574c0bb7f17983746522000a9c7061a5c7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
958e3ff8f14dd0389b7fa9e5d3ea6af7

SHA1
299aa2e4eb0c129a3dc43f2b3edd84c5683df468

SHA256
386d46262469e2b67618276e087834d90422f72c29d44abb081574926347692d

SHA512
e77efe52d5f4df8e42d351a604202ca6518f14042740ed19e1a243ef6c866e6f4981da45f9e95cf8787f09d729360a62f466d51aa7858d72fa571f5c9d907906

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\AlternateServices.bin

Filesize
6KB

MD5
2ac6f6268fb37f065e83fe289e984c7d

SHA1
174b6e41a95714cadf5a20f15873d4d38e7cf5e5

SHA256
8d8d5d3fddb3cc6e52fc0811916ce643567b3e58d166ba201a56c594fbf6fea8

SHA512
b19af2aae947c4eb90d8dc6d80737895e508533ffa0549addab2193b389f69c75f0f1f00491bc9c1e50cdbb623d5db39a90ddc059e2673048b9d21ea25cc1e90

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\SiteSecurityServiceState.bin

Filesize
858B

MD5
0ab01ed446da4b15a6fe1fba53eeae9f

SHA1
8abf804ea5b1b167f9ac51a655cbd4b46006e3d2

SHA256
3c9b4b8ba8af64f064020bf79c24b66e4892dec140328ab9df503389fdcceec6

SHA512
297ddf2919dc324df5656d1d7c2247518a66a9968f2fa2b9a5439dfc46bf8e80496925e2e7ec4d359a7c6c2f6b1527e4cb9612c10790f448e191f9afedb7376a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\content-prefs.sqlite

Filesize
256KB

MD5
b5acd9cf58ba89e643e7b2e839e0707e

SHA1
82c2b9cbea4acb50b446b786818287be7b0b8b61

SHA256
4d4fd87f1cdccc9f826ab7de2b3980db6fe4ed328f079ceb24f680557da9667e

SHA512
1fdaf5173a2fa956e3793b3643b44d928a4c81a1599bdf4b057396bfca5948ce1097194dbb5f528959c8cf4e34d058922828236c6060b41510e9ea2cb9ed424b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\db\data.safe.bin

Filesize
6KB

MD5
4216a87d616211dcdfb74e79c864ce8b

SHA1
ab8946c796d41ac173ed8939415aede0f7353c51

SHA256
7a7323eb6b1a01452e2457d68295b2c4c49a213cd7534d0d0079dec1a41bcddd

SHA512
8df1f2904517ae7ea34247ab9557b6009897f4d903ceee3dc6bd286ff57a1975c3498ff6769ff1a55d21ef14d2b6b4b3c0343bb9f8c30ab02bdf308cceb763f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
4d759cd4d2815e832e15eafc25057b37

SHA1
4c3ee4c773c8b0ac7d6af151e803de3f1e8d6ed9

SHA256
234bdd023e0dc16726b8c780309e6715e0024e5c87185ad672b50dfbf1dd0cf9

SHA512
d6006252ddde472fb5e47f489f47b71ce67debb4632fcc1d0995933ade579791c440a102130015ed8981c708f55cc20c5a04bacc764c6de91f24c8e074230ef0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ab189c61bfde8bbd8e55d263dbfd11e4

SHA1
c96ae3c4ae1fcc0745100c37a9ab2fc69147bd56

SHA256
23c812daa630fb64b755ae27a6d968b8a09b55ba38180da2d67ee93316e5f0df

SHA512
7bcdaaa489abe7b5fdc2a59df52490313b6538e1cbaf22878163d643cb18944adae150f197d13c096ad628dc7d748b0661430cbe4a4fb91799a9f81fddeffedd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\events\events

Filesize
104B

MD5
defbf00981795a992d85fe5a8925f8af

SHA1
796910412264ffafc35a3402f2fc1d24236a7752

SHA256
db353ec3ecd2bb41dfbe5ed16f68c12da844ff82762b386c8899601d1f61031d

SHA512
d01df9cab58abf22ff765736053f79f42e35153e6984c62a375eb4d184c52f233423bb759a52c8eed249a6625d5b984a575ca4d7bf3a0ed72fc447b547e4f20a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\pending_pings\13fca6b3-e90a-4f3f-9f65-792d6f6189f8

Filesize
905B

MD5
3f990746fd6e6167afa687ea442684cd

SHA1
e6eda143efa1d6b62c61195bd1a7a0ac4a7202c5

SHA256
39266571a329b3b302ca0274b1bcba269a269313699e8a3c0d83318ebe3740bd

SHA512
feed38280e5a83c99f35862d67b0eefa359220a10e1928e452fc685b9bbf295786a07d99a7faaf5af125a499306542b357cc730af4bd3201b245e9803ba2b6fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\pending_pings\3583329a-4243-4c2e-83a4-617ee52efa44

Filesize
693B

MD5
781afd1295af3ddb0c54d88d22ff1058

SHA1
e169f9936b01189f59468f775e729afbe263756d

SHA256
28db6b481fcf3701fe3d7e4dccf5c44ef01a5c1b41b339fd3d10c3a629e28c07

SHA512
0d1ad253f3b985244fa0f6d2d7bf9798024f158f95e669391292613c078a9380a1acb68bd6ec8c22dd0a3c696889dad9fbd80a50c8396596bab267a258f2cc48

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\pending_pings\5da6bb21-9edb-4f9d-9f75-9329be696821

Filesize
25KB

MD5
6130a1cad7a0ee4485c733a2e77be749

SHA1
7b4432d4e01dba577dd4e72f2f54f53962430ada

SHA256
ee5815412ecbd321530ba7d7aa226b5dcd134736bfe0e5789d416e27f6ab2c1a

SHA512
4fc650b3323aa6d41455ab723d494f3611bce2b4ecc13f124a26164de5576958f753db737fd2a9bfd6d4df1b5be52a015e915a5cb9e707266c01250ab91a5bab

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\pending_pings\681000bc-3525-4cee-9025-0018406b2b50

Filesize
982B

MD5
727f062570aa1ce4512df877cf36d9d0

SHA1
1566ebc89365c85f03f96b99bdc4e9ca8244da50

SHA256
2a6c660e59d82121e18e15524a2a16cbfb211bf68f2bf79aad225092c586d4bb

SHA512
84897075e29e68ee8b5e8e727f34a68775715065ed149859e973bf0ac16f2a87fe12f674eb6ec013933f4b72368f5d3b714f738d48fe1bc9de398f31e4baebbd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\pending_pings\72f13a41-5332-4895-9d40-d8983c3ad5b9

Filesize
653B

MD5
178c4e4c375286f614a1af5be791544e

SHA1
cfc4499704db5d2ffc12345ae980449c20b52f37

SHA256
32eb42ba81e5a0cedd567129abbabe7e7b7dda5140ab39f5e79223aa5ef548cf

SHA512
267268a67008b2b24ccf7b687ab6127b37c140299c84f6e7cf9f5866c42621bc9a84fe7e70c4ca834d6199097294d6a7d644ca331136d04d5f57c75226a5ea54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\datareporting\glean\pending_pings\8f0cd3ba-dd7c-4db9-8869-c38bbf18a435

Filesize
671B

MD5
b9b6ab78dde31dca5740f837b5b36f06

SHA1
7715d44b3789e6c618fbb509d7c0ce101105ffba

SHA256
dc0473d335dadacf90e6776e51c2e2c1455ad8163a1802e973d4ff1133f893e0

SHA512
a355537ba632b55fdcedde8f57b08a98cafa1879e235976531cabab96db90e3f72aecd5052f3dac9a6d627e03da05feab7a8cfe0ba57661af12692ceb276c478

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\prefs-1.js

Filesize
9KB

MD5
8139520f743563639680f25ba6b034fb

SHA1
0dfaecb87376d7a04ce43b53fa4ed31d2a09d344

SHA256
ebe6f29ccf1f1c0c1bf6e983b1b5423d80ed4283cf0e0c5ea1fe58c00d731263

SHA512
e60740ed55ce92a37c172ba5b8e99728e3ec4fe8095f2b7aa606b1195543c95a6e458917a0e0b661f4a71ed230e33fb774486bed29cbe6628c111cf3be5bd8bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\prefs.js

Filesize
9KB

MD5
84f0a502d9451125a9fe6c86ffd9c81c

SHA1
dc9de4fb208c05ecd26eeea376b93a259995f97d

SHA256
8c042a5d2025f59244d571ab5433ecc76bfd01b195eddafdacc529cf106ae0a7

SHA512
e9c7f79520e483df8d6b32644368eafc49649850c8f8437cc602f5428b2998e63aa4851aceafac5903aec673e15a7deda51d5109486fa36915d8f1f827f40667

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\prefs.js

Filesize
9KB

MD5
ed7d82ad572357ba51cb5735ddad45b5

SHA1
6870b8621a0b89e22120a9d9b00f9c7b54a6b28d

SHA256
2f763f7c718a00ad7b3c00913336c4e10afb8eb2c7978fcd0e171888ad606447

SHA512
fb5fe156de4a97115c73d747c2cb9d35083215582384b0c8e0c2891c99b60b108356edac66a527978f40c59f11ba8e52e16635081a3dcc2451be28994c1e5fbf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\prefs.js

Filesize
9KB

MD5
4ac68d21a733607a5a7b06856f0b172d

SHA1
96f82343d447c1051c7cc0854f5cbbc763b1fe99

SHA256
2b3e93dbb07e44d73fd46d3f015f595948bb18fd881f028f17605aaa8a19463f

SHA512
8bdc20b1518ee2475752e21b301f97e51869dd5382c7d4ca26d43175e53e6cfabf15f7ace4a70bbaff2b90aa00f0967f6aedb43fd9c0e57fae829440c1587c0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\prefs.js

Filesize
9KB

MD5
a3949fa35988577da45180e1366a410d

SHA1
c14cb9ec79c974c079c333f6604c1b8d553c7eb7

SHA256
2a297c88a6106c8405575af1de1858d1f0f6dfa2d37a62fc50d2c8da8a966980

SHA512
73241f790dba83e8a1744d391f8eed24905e6e34a212fad2161b20c59454bfc034a743c25e175a844001e444a6089165d4f4643d96d2de947f249867a71ae2f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\protections.sqlite

Filesize
64KB

MD5
76786a4c0dd19d88d6d3ed95a293bf2f

SHA1
b0d6d676127a7694fc6e71ee57fcc2ffaa621ff7

SHA256
1a2564c1ba20b8038d35c2319258d94dc15d97914dcf753b31c48b79940dfd31

SHA512
8cd3298e2ebba763d3c80ac4b17e44af7eb63b46304967d0c6316d314baf8611c05f7b9979c2c5c329ac167aea0246e8c9f057ffbb272481c13fd5e4b4bcb2d0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3n2hkb1.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Filesize
48KB

MD5
ae8c91f68fb7a9968f87442e535a90fd

SHA1
181e6549ac431881464c300caf0b2652bfa1ac53

SHA256
3497993efa08f26655f5275e776f2db82972bd839a8d234c8ac3516fef7d3cd0

SHA512
9e68c862cbac5619622d51b4a24abb23bc12331b6d16550917fb32c72ea2ad85c6e0027a595661d1f0be6d6952b18429b5ecf7226658a66c788ec228953edd68

Download Submit
memory/2336-302-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/2336-328-0x00000000060A0000-0x00000000060F0000-memory.dmp

Filesize
320KB

Download
memory/2336-298-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2336-301-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/2336-641-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/2336-584-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/2336-329-0x00000000062C0000-0x0000000006482000-memory.dmp

Filesize
1.8MB

Download
memory/4512-300-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/4512-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/4512-296-0x0000000002CB0000-0x0000000002D1A000-memory.dmp

Filesize
424KB

Download
memory/4512-4-0x00000000053B0000-0x00000000053BA000-memory.dmp

Filesize
40KB

Download
memory/4512-5-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/4512-3-0x00000000052F0000-0x0000000005382000-memory.dmp

Filesize
584KB

Download
memory/4512-2-0x0000000005980000-0x0000000005F26000-memory.dmp

Filesize
5.6MB

Download
memory/4512-7-0x0000000005520000-0x000000000553E000-memory.dmp

Filesize
120KB

Download
memory/4512-13-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/4512-1-0x0000000000850000-0x0000000000924000-memory.dmp

Filesize
848KB

Download
memory/4512-244-0x0000000074A20000-0x00000000751D1000-memory.dmp

Filesize
7.7MB

Download
memory/4512-6-0x0000000005470000-0x000000000550C000-memory.dmp

Filesize
624KB

Download