amadey | c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d

Analysis

max time kernel
150s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
12-07-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
Size

1.8MB
MD5

a7a231ef5b7166696111b8b2151f0b2c
SHA1

4ae6e23e6a4c23dc421775a7a55f2329aa975d5b
SHA256

c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d
SHA512

27756ffd4b67dc8034ef3d168fae3ba042da75ad7a5a530764bfd9418c8ed79f9b1edf056633e3d0d89c974a57e704a11ea923bed13e81e0beefdc43f1b7fb15
SSDEEP

49152:IEDUft+bKru4cUDmA9/gidI4zXgXAKWuFuLqeRCwXCoT42Y:IEQftLrnl/gid9gXOuvejSl9

Score

10^/10

amadey stealc 4dd39d hate discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	HDBKFHIJKJ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	HDBKFHIJKJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	HDBKFHIJKJ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
5740	explorti.exe
3884	a08feea111.exe
5220	459af31eb5.exe
4616	HDBKFHIJKJ.exe
4036	explorti.exe
2836	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000\Software\Wine	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000\Software\Wine	HDBKFHIJKJ.exe
Key opened	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000\Software\Wine	explorti.exe

Loads dropped DLL 2 IoCs

pid	Process
3884	a08feea111.exe
3884	a08feea111.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002ab34-42.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2764	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
5740	explorti.exe
3884	a08feea111.exe
3884	a08feea111.exe
4616	HDBKFHIJKJ.exe
4036	explorti.exe
2836	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a08feea111.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a08feea111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3171217504-1685128607-2237314850-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2764	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
2764	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
5740	explorti.exe
5740	explorti.exe
3884	a08feea111.exe
3884	a08feea111.exe
3884	a08feea111.exe
3884	a08feea111.exe
4616	HDBKFHIJKJ.exe
4616	HDBKFHIJKJ.exe
4036	explorti.exe
4036	explorti.exe
2836	explorti.exe
2836	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe
Token: SeDebugPrivilege	1728	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
1728	firefox.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe
5220	459af31eb5.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3884	a08feea111.exe
1728	firefox.exe
5500	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 5740	2764	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe	82
PID 2764 wrote to memory of 5740	2764	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe	82
PID 2764 wrote to memory of 5740	2764	c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe	82
PID 5740 wrote to memory of 3884	5740	explorti.exe	83
PID 5740 wrote to memory of 3884	5740	explorti.exe	83
PID 5740 wrote to memory of 3884	5740	explorti.exe	83
PID 5740 wrote to memory of 5220	5740	explorti.exe	84
PID 5740 wrote to memory of 5220	5740	explorti.exe	84
PID 5740 wrote to memory of 5220	5740	explorti.exe	84
PID 5220 wrote to memory of 1816	5220	459af31eb5.exe	85
PID 5220 wrote to memory of 1816	5220	459af31eb5.exe	85
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1816 wrote to memory of 1728	1816	firefox.exe	88
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89
PID 1728 wrote to memory of 2424	1728	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe
"C:\Users\Admin\AppData\Local\Temp\c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Users\Admin\AppData\Local\Temp\1000006001\a08feea111.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\a08feea111.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3884
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HDBKFHIJKJ.exe"
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\HDBKFHIJKJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HDBKFHIJKJ.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\DHJDAFIEHI.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:5500
- - C:\Users\Admin\AppData\Local\Temp\1000011001\459af31eb5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000011001\459af31eb5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1728
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1872 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cab01d5d-c0ff-4e66-9dde-e9da16592a21} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" gpu
        6⤵
        
        PID:2424
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2408 -parentBuildID 20240401114208 -prefsHandle 2316 -prefMapHandle 2320 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1503ed6e-6efe-4bc8-889b-138ec203e127} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" socket
        6⤵
        
        PID:416
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2568 -childID 1 -isForBrowser -prefsHandle 2840 -prefMapHandle 2960 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3edaddc-4855-4944-9de4-b7c90127907f} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" tab
        6⤵
        
        PID:1780
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 2300 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c956f294-c407-4b63-80da-0536c307c47c} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" tab
        6⤵
        
        PID:4544
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4848 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4140 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0de77787-03b2-498a-926c-3caed5e1b8dd} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" utility
        6⤵
        Checks processor information in registry
        
        PID:2464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5444 -childID 3 -isForBrowser -prefsHandle 5560 -prefMapHandle 5588 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c48da92e-39e1-44d7-b073-8affc6c8c2b7} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" tab
        6⤵
        
        PID:3140
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 4 -isForBrowser -prefsHandle 5724 -prefMapHandle 5728 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32c18d61-331b-44d0-96dd-64a4cf0f1be5} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" tab
        6⤵
        
        PID:4980
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5996 -childID 5 -isForBrowser -prefsHandle 5916 -prefMapHandle 5920 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da4a53ea-9dfb-4052-912c-ace6a49afbe1} 1728 "\\.\pipe\gecko-crash-server-pipe.1728" tab
        6⤵
        
        PID:1748

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4036

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
de24714c4090cee1a0efcd6556078097

SHA1
4e695dfc6e30bfaa6b34c5cd5203a26a983a758f

SHA256
a49be59e68bc23357b3936720c9a38564c90c5bb6908d333fdc5ee1f6019021b

SHA512
3f8bd1e3e84757c32f4431a73c3aa420f0a64c3281e28d545981876f946655c5fc3f7f3220b6cca0ac7d2359e8b8fe518f1c23a9f4ee8ec698636d1214c538f4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\cache2\entries\5CD1EBDF6B57F13C7E783CE5E6D8E9C44014FE1A

Filesize
13KB

MD5
7fb147961b5007759a260ee4ee00ea82

SHA1
3bd7bbd4352e5ebbd2e7283aa775ea41d973ef27

SHA256
9dbf09e57aa7b37358d64edd2df81824d495053a67b684bd753b690bf2be82ce

SHA512
8813ddfe9c9799f1ec1b63ed5e9fd32a2bc574e1548dd0206d45df6b4f9f3ab7dec7e0bb19769e0bfa73d89aa520783a94ae32bc0931a78ccafd1892d64a6ca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\a08feea111.exe

Filesize
2.4MB

MD5
08c7502b3315ce651b6b57849c1d7308

SHA1
25d8366a04fca7105e7c38eac267ab787456f8c3

SHA256
d25e817eee335c0f2baaf75f39e40ac410fbbfb2089d20f604718ccf053e27d4

SHA512
d3b352b9bcd49b4ee412fd43c5bd6be752083f4dfc20c0cf31f48003b28a9ef7171290ffbb47b8d31714afa945db78a2b4911d5963c2e63533e3bb66947bd64d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000011001\459af31eb5.exe

Filesize
1.2MB

MD5
c9d56cd0a203897f2a7e757c6f56367d

SHA1
f3ce65c3ddbc08ed507de1486992ed5d4dd67b6e

SHA256
7f797431b98fc646e12d1c85be00527bd78a991830dc5160188ab77854959f4d

SHA512
ad06efb0e7c6fd32c4e19929dd63bf4e53562f03ab9a96b8f45a115361cacb984aa2bb0600dffd1d9f68d2a60fb781449097fe1cfe78c10b3d9a2c2f3cb2c63e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe

Filesize
1.8MB

MD5
a7a231ef5b7166696111b8b2151f0b2c

SHA1
4ae6e23e6a4c23dc421775a7a55f2329aa975d5b

SHA256
c5f17aa887d0c753fe45bc555688baeeed494d445867cacbad8ba570a2a5249d

SHA512
27756ffd4b67dc8034ef3d168fae3ba042da75ad7a5a530764bfd9418c8ed79f9b1edf056633e3d0d89c974a57e704a11ea923bed13e81e0beefdc43f1b7fb15

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\AlternateServices.bin

Filesize
8KB

MD5
c0a105b0dd0432eb2800b2ee20f416a8

SHA1
e6a5e073f098d0497fb854f81b78041131f71cd4

SHA256
c634c3d9c2bbf3f9d9fd953b815bb83135d8f779080a34da070d48711832eb59

SHA512
ffa93d4c1aa1d588db671334c941a3ef2b6465ab6ccb3d32a4b2453dc1da37a33dbd377b0266daa98d24ca0cbeee1aeaef5581a7784dae000bf2ccf5d6f57eae

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\AlternateServices.bin

Filesize
12KB

MD5
35b26d4401ce021eea5c2928246c68b8

SHA1
6d32720baea1062a3a36ad67f7516957812e0f51

SHA256
2b4f83461a562e8335c496fca46200c3dbdd3b7ddf2517dd40da15c921ccd83f

SHA512
bac56b68dc6dedfadf8f53b4ad98a3da9e4212617e44e13b137f56f499affb3303a09d1087b8107f687f79024fa3cd4b9f73c6793e846e85d61b27bf327a8cf3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\cookies.sqlite-wal

Filesize
192KB

MD5
c3aac37a50304d7b2b35375739f8cba3

SHA1
1e5e16ab75b4484a1778e71e3bb0479ad371f12b

SHA256
ce47f3c85f2ff62f66794a9e7378a7f3cff4bc510e9d3e7130529a34db4b81a1

SHA512
62f7579da1b7b2efa5658b9f5651a1fbc892501b697c716be11d77b2f416e97220826ecf0045f0c614731c522ae03340a76bd04b1c57a56b8a8b65a329ea4bd5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\datareporting\glean\db\data.safe.tmp

Filesize
16KB

MD5
f7c5fc22fc8607e17ea8f6db61a338a5

SHA1
988f92deea94fc0182010cda2fbe1703328faef0

SHA256
96176fd83fc9a8507b82f7c2db16a8c5f862725a1306e867553a9b4e47e338c9

SHA512
04799ced738678d55dbcf9a70b2c593de60e98684989e63966179b216b090692bbeea3a2d712a69a87feff94e358d7094657668a1f3e8005549203712a5d6a1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
81118c4bb4254e1032c02b21bdfee1e7

SHA1
e7f58d9a9cf5d50214ce5e8aeb59602ac963c85a

SHA256
8b8f967970c19831c1ee3c47618642e998d12b8989e97ff6217519c33fb82018

SHA512
b115bee974bae14a14f40cb49b44179755716470fcdff516aa91ed3591d252c176a99bb1c49fd86bc4fb4e8870cb3a17f4e9a63c69245d052b1c984796aa37e0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
3273174e90b52747117f77371b5a8731

SHA1
11b1ac4c9c76b79b26b7b2aafebf58be41ef8739

SHA256
5291d1b9c0540c13a89c457e6f6148fb6ac0662c7492e7268b677ca112921a87

SHA512
ab49918b25d2069fe0252b6112f7ba380a32ccd7c235c69717b73396855d8c536dddfd56c60263fc1e999a19117ed688c9dc121317484cc5b4a50051c1bf2317

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\datareporting\glean\pending_pings\22681845-625a-4c57-935e-5213cfcec6b2

Filesize
25KB

MD5
09db98dccf506b471016a137ff913b72

SHA1
f3d2fc83f5b0b2d816bea7cc2972971198da0f86

SHA256
be8d69c4a5529e442f277f5232b4e933be3782ce562f903141452384719202c2

SHA512
15c64967e756c839a258f1571e15d0b67c2a288ec0ca84295f6543410e6b2786ac7766e888ba7386a617687308daa43e0acc2c793384efab2d9380aa104256ce

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\datareporting\glean\pending_pings\7911c036-8684-4708-b850-3c016f693485

Filesize
982B

MD5
7cb3ffceaab61d3cef5af29dab66b92b

SHA1
6cdfcf7bc1b534cf8a80d2d1f328cee1b6ce5226

SHA256
402bc23303a034772ead11a35e785c893b73d0b1de5ae00a05954f7411bbee62

SHA512
51b0c39cea3d67a129d7a0999f4509527c5c43fbf7e1418ff4f7d398077ad999337c7cec65bb56f2bc1aa680e931880fccaabad7fcb990fb07807909c839ccb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\datareporting\glean\pending_pings\dabc4dee-a4af-409c-b734-8203da6e5d2b

Filesize
671B

MD5
3c4ac67c7cf45fb5b6e4e0ccccfa8f1a

SHA1
229aae8b081d98d93ca41a6141b27a7bc163aef6

SHA256
07fd2ea85960fe1a860a62dc7a242adaf3d93bdd4487bfc2a13b4577b942cf8b

SHA512
1d2f3949ce50f0491f23042ed00212662f076e572556ff68fdaff1f3f36e56f0d5b8b7d2884dcfff5992e92255d032c648a9139079ddc544080d335c87373b94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\places.sqlite-wal

Filesize
992KB

MD5
a85f14a36e8e73db49744f1116a02338

SHA1
40de167a9813ceea2e98f8224a5fc0a1034fae6d

SHA256
c806528b9a8434e234344b6ec79cad80fa88ec3d1a5cb9c8d1f545dde09bf3ec

SHA512
d49570bd6a753c90894c446cc0f332334dea4ce74ca2ec183d2832fe622f9abc799481e10c50d3d5b9bd364f204426b9ace0ebb5f1fe004595c42ba40d47b3d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\prefs-1.js

Filesize
12KB

MD5
03e88a6b72d75462c3bd06c0f3c6c4a3

SHA1
fd2f02499b00287ebd11c30abd207aa420b270ae

SHA256
846f39bc8d2e909fe372a4b416efb8979dabbabb79f45070674fe51464417c7c

SHA512
1b101b26ad1e71213d831e847e06a60178e12898b79d229039116ea9c55e199e6adbba5efb80e39d87f4fd220399c9c9b370dd6c72ed236eb4af586993c314f7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\prefs-1.js

Filesize
16KB

MD5
dc9a4da9c258d99cab0bb3e1ba738420

SHA1
3e9d35135ac90fda1312a329d9b4105ca20d6390

SHA256
de2e183caee49cd8f9dd6fd39bb4d22f1502a4bb200239c057e22016880d1850

SHA512
41dd2472c2fbe29e7e0825bff6b4ed0892692815ed09cd391e318fc69e4e66684757f1e7e171071a9f9458cb2d1ce7220381408c0698b6adc2a93b061335b8fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\prefs.js

Filesize
11KB

MD5
400c72729fff699e1137d1f418841ded

SHA1
5c5d6eb4bd96b56e448e4afc9ddb1dfdabb443f3

SHA256
87ec97a1fc222c22be09105df131ece4bbe7cc5efaf11928c553d2382dae76b2

SHA512
d6ad394c4c782538e8bd8bec66044e38738b330b888d3e5cc0079ac0c488fd6aba65fcd9606584dbe1636a10c34a56dbbbbd5283148b058515e4f9a9e8564ce4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\m7qr6qvv.default-release\prefs.js

Filesize
8KB

MD5
18cacc8cc0d6ff15169421cc905ae1de

SHA1
7c06f0b9f005da1db19bda11f8df13b3db5f705e

SHA256
72b78808a04c005fb83a9526fb0c8b148bf2ef7f4ab51f69d3daa7c11a0523d5

SHA512
e9edc23d5fc330595c11a7a5e87b3868639e1aa029c139ed67e8fcc6d7208bff28c9fc769c11f3443a4fd5c2384424469e2f39722eb13e1db95a52952da59c08

Download Submit
memory/2764-0-0x0000000000E10000-0x00000000012D2000-memory.dmp

Filesize
4.8MB

Download
memory/2764-4-0x0000000000E10000-0x00000000012D2000-memory.dmp

Filesize
4.8MB

Download
memory/2764-17-0x0000000000E10000-0x00000000012D2000-memory.dmp

Filesize
4.8MB

Download
memory/2764-3-0x0000000000E10000-0x00000000012D2000-memory.dmp

Filesize
4.8MB

Download
memory/2764-2-0x0000000000E11000-0x0000000000E3F000-memory.dmp

Filesize
184KB

Download
memory/2764-1-0x0000000077036000-0x0000000077038000-memory.dmp

Filesize
8KB

Download
memory/2836-2654-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/2836-2653-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/3884-56-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3884-475-0x0000000000100000-0x0000000000CE2000-memory.dmp

Filesize
11.9MB

Download
memory/3884-472-0x0000000000100000-0x0000000000CE2000-memory.dmp

Filesize
11.9MB

Download
memory/3884-37-0x0000000000100000-0x0000000000CE2000-memory.dmp

Filesize
11.9MB

Download
memory/4036-1638-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/4036-1800-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/4616-480-0x0000000000650000-0x0000000000B12000-memory.dmp

Filesize
4.8MB

Download
memory/4616-481-0x0000000000650000-0x0000000000B12000-memory.dmp

Filesize
4.8MB

Download
memory/5740-1921-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-488-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2641-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2649-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2647-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-487-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-807-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-19-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-479-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-18-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-21-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-20-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-501-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2650-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2651-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-468-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-467-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2655-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2656-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2657-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download
memory/5740-2663-0x0000000000C30000-0x00000000010F2000-memory.dmp

Filesize
4.8MB

Download