amadey | a1eff1aaed6950dd710f372001f4cb1cf4092b0af4c9d9527db0b267624b3f4f

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/07/2024, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 2.4MB
Sample240715-hhhkmashpl
SHA256 a1eff1aaed6950dd710f372001f4cb1cf4092b0af4c9d9527db0b267624b3f4f
MD5 b26dcc8942a0a048f694c735358ddf33
SHA1 1fa45273a085340e7797e9e2a039f9fc9391744c
SHA512 f03c88c854cd4ddb1bfda877e49a86705dbf55095235b632b9f42772f7b6f1bad049d01558a96652b9873f510428d90d8188a43ca14e3381c0fd5f766f49580f
SSDEEP 49152:bgZBZajIJYae4a3JWHlBEhCh/bsc2eCIpsAG2ECHUe1R1qpNmIE7gd:U1oie3cFLFyUCAhHUe1R1qpNZr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d funny discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

stealc

Botnet

funny

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AAEGHJKJKK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AAEGHJKJKK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AAEGHJKJKK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 4 IoCs

pid	Process
2932	AAEGHJKJKK.exe
2352	explorti.exe
2284	e5add2d445.exe
3028	4c4b4c7b68.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	AAEGHJKJKK.exe
Key opened	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Wine	explorti.exe

Loads dropped DLL 7 IoCs

pid	Process
2416	file.exe
2416	file.exe
2684	cmd.exe
2932	AAEGHJKJKK.exe
2352	explorti.exe
2352	explorti.exe
2352	explorti.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00050000000193d5-147.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2416	file.exe
2416	file.exe
2932	AAEGHJKJKK.exe
2352	explorti.exe
2284	e5add2d445.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	AAEGHJKJKK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2416	file.exe
2416	file.exe
2932	AAEGHJKJKK.exe
2352	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2932	AAEGHJKJKK.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe
3028	4c4b4c7b68.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2416	file.exe
2284	e5add2d445.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2684	2416	file.exe	32
PID 2416 wrote to memory of 2684	2416	file.exe	32
PID 2416 wrote to memory of 2684	2416	file.exe	32
PID 2416 wrote to memory of 2684	2416	file.exe	32
PID 2416 wrote to memory of 1680	2416	file.exe	34
PID 2416 wrote to memory of 1680	2416	file.exe	34
PID 2416 wrote to memory of 1680	2416	file.exe	34
PID 2416 wrote to memory of 1680	2416	file.exe	34
PID 2684 wrote to memory of 2932	2684	cmd.exe	36
PID 2684 wrote to memory of 2932	2684	cmd.exe	36
PID 2684 wrote to memory of 2932	2684	cmd.exe	36
PID 2684 wrote to memory of 2932	2684	cmd.exe	36
PID 2932 wrote to memory of 2352	2932	AAEGHJKJKK.exe	37
PID 2932 wrote to memory of 2352	2932	AAEGHJKJKK.exe	37
PID 2932 wrote to memory of 2352	2932	AAEGHJKJKK.exe	37
PID 2932 wrote to memory of 2352	2932	AAEGHJKJKK.exe	37
PID 2352 wrote to memory of 2284	2352	explorti.exe	38
PID 2352 wrote to memory of 2284	2352	explorti.exe	38
PID 2352 wrote to memory of 2284	2352	explorti.exe	38
PID 2352 wrote to memory of 2284	2352	explorti.exe	38
PID 2352 wrote to memory of 3028	2352	explorti.exe	40
PID 2352 wrote to memory of 3028	2352	explorti.exe	40
PID 2352 wrote to memory of 3028	2352	explorti.exe	40
PID 2352 wrote to memory of 3028	2352	explorti.exe	40
PID 3028 wrote to memory of 536	3028	4c4b4c7b68.exe	41
PID 3028 wrote to memory of 536	3028	4c4b4c7b68.exe	41
PID 3028 wrote to memory of 536	3028	4c4b4c7b68.exe	41
PID 3028 wrote to memory of 536	3028	4c4b4c7b68.exe	41
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 536 wrote to memory of 1372	536	firefox.exe	42
PID 1372 wrote to memory of 268	1372	firefox.exe	43
PID 1372 wrote to memory of 268	1372	firefox.exe	43
PID 1372 wrote to memory of 268	1372	firefox.exe	43
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44
PID 1372 wrote to memory of 2824	1372	firefox.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\AAEGHJKJKK.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Users\Admin\AppData\Local\Temp\AAEGHJKJKK.exe
    "C:\Users\Admin\AppData\Local\Temp\AAEGHJKJKK.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
      "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\1000006001\e5add2d445.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000006001\e5add2d445.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\1000011001\4c4b4c7b68.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000011001\4c4b4c7b68.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3028
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.0.1841774724\882777421" -parentBuildID 20221007134813 -prefsHandle 1288 -prefMapHandle 1280 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {54bde0be-bd96-4043-b935-2d08988098b6} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 1352 f9d6d58 gpu
        8⤵
        
        PID:268
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.1.1179714975\759931810" -parentBuildID 20221007134813 -prefsHandle 1560 -prefMapHandle 1556 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3fc1db3-5ddd-4f0b-aff1-1a2a4f87638e} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 1572 e70758 socket
        8⤵
        
        PID:2824
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.2.1041611395\1060286146" -childID 1 -isForBrowser -prefsHandle 2204 -prefMapHandle 2200 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d6aaa71-dc3e-43a9-ae69-582120c49f0d} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 2216 19fe8258 tab
        8⤵
        
        PID:1812
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.3.1996244569\2538273" -childID 2 -isForBrowser -prefsHandle 2768 -prefMapHandle 2764 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64181c73-013f-47fd-9246-ba1d263ebf01} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 2780 1c33e058 tab
        8⤵
        
        PID:2388
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.4.1282887706\2031434843" -childID 3 -isForBrowser -prefsHandle 3796 -prefMapHandle 3792 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1bfd2ac-1793-4199-9aad-7b2cbf688bd7} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 3808 20223d58 tab
        8⤵
        
        PID:2356
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.5.1430058421\813903024" -childID 4 -isForBrowser -prefsHandle 3944 -prefMapHandle 3948 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8897679f-c5a2-4f93-94e5-de06c574b9fb} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 3932 2035d558 tab
        8⤵
        
        PID:2208
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.6.2112414972\74225713" -childID 5 -isForBrowser -prefsHandle 4044 -prefMapHandle 4052 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 700 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37dda1d2-cdea-4c50-bc29-d40943b9739f} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 4148 2035d858 tab
        8⤵
        
        PID:2560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\IIEBAFCBKF.exe"
  2⤵
  PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\id09dv1m.default-release\activity-stream.discovery_stream.json.tmp
Size 28KB
SHA256 51ee8d91f6bb9cad082a7a1bbd5246c8200b0a6e5c32b1debac562ec4a2fd886
MD5 1518467542e9d84cc9a8810ef5c6ce4e
SHA1 c5e06efe366a244f0964dd69b66bde68925dd659
SHA512 ebdbf67c78d3c0e2d6ed8684380b632dd925a07cf97511bd6ab2ca04a44030e3295007dce727cc7e6cf2983a1c44fe99958b86c6cb7cb15d6608afe115eb6a06
SSDEEP 384:zelPpwk99tFW6MvdTDlmDX6Eu6SNVUcCgKSyauJ1DlcDOy8rNlC2Nlil:zeMkUv9RmDK3zNvyddLy8zZil
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5add2d445.exe

Path C:\Users\Admin\AppData\Local\Temp\1000006001\e5add2d445.exe
Size 2.4MB
SHA256 a1eff1aaed6950dd710f372001f4cb1cf4092b0af4c9d9527db0b267624b3f4f
MD5 b26dcc8942a0a048f694c735358ddf33
SHA1 1fa45273a085340e7797e9e2a039f9fc9391744c
SHA512 f03c88c854cd4ddb1bfda877e49a86705dbf55095235b632b9f42772f7b6f1bad049d01558a96652b9873f510428d90d8188a43ca14e3381c0fd5f766f49580f
SSDEEP 49152:bgZBZajIJYae4a3JWHlBEhCh/bsc2eCIpsAG2ECHUe1R1qpNmIE7gd:U1oie3cFLFyUCAhHUe1R1qpNZr
MD5 SHA1 SHA512 SSDEEP

Submit Download

4c4b4c7b68.exe

Path C:\Users\Admin\AppData\Local\Temp\1000011001\4c4b4c7b68.exe
Size 1.2MB
SHA256 4e0fdb84649ad15a0722789512aaef15c7bfbc4cab82b2a7b0ea52ac9594bb95
MD5 dd831eb4a822421a497990d84a0fd578
SHA1 aa7ee9cd7fcdb6e0f15c57f6f99c83c320480f3b
SHA512 5a894b58d5d6b3a6abedb687caa16c06344d87b6d8e5bfb39d5b9806a7b51f3003e3ae83871683d086a760ea987a42bff511d4cb4d723a9e52744ea8aaf9b73e
SSDEEP 24576:4qDEvCTbMWu7rQYlBQcBiT6rprG8aLY2Sbly7TWEPje:4TvC/MTQYxsWR7aLY2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AAEGHJKJKK.exe

Path C:\Users\Admin\AppData\Local\Temp\AAEGHJKJKK.exe
Size 1.8MB
SHA256 77b7b05a19d95c448654ec7a20764f69868362af729ea7f2a917aaef7aa3fb1b
MD5 2452db1580ee0120f7c04db9ae6bb5d7
SHA1 125ba3815728e61c31f44d882a165289bf789613
SHA512 5cbd408ec85035f68e6e9d1691bc2d554fabaa3133e633784c1b7bb276ba9ad5c618a0450374ed1cb21ee6bba1c2bd9abeb08850bcd75830f9f0d3c6542e43cf
SSDEEP 49152:BkF+bfdr/PowpJxvctNDtSQf12Nr5AsSA2qNxxmtr7/3G:BkcbfZtcXlfWpDN70H
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\db\data.safe.bin
Size 2KB
SHA256 335b01b9c96052fcce6898073132366fc9a67af50535c4f8917fd289e542b306
MD5 e28a9f6334ce1d79bdd639ee0f0dc9e8
SHA1 391a996e16f6a2381eb3df59bd8865253a57db4c
SHA512 1af5553d4f44ffab8d1e8f361aada55537855586c14ba45ad32cea654e4aafb43c2b1fd5075ca44efc6dc6b1a87cc0ac9be84b917b7590941e3d7fdf8cde58d6
MD5 SHA1 SHA512

Submit Download

0aaf8c56-eaf6-4453-9532-33a825ab9dfe

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\0aaf8c56-eaf6-4453-9532-33a825ab9dfe
Size 11KB
SHA256 6eb40bc59c8108838a75999c0f414982db68c4a731f74fae45d97a04f7a04439
MD5 e9f445dcd4e3398330733a7f9148e942
SHA1 6353d770fb7712c6d3bcdca495172cafc8f24879
SHA512 1d269ec6923ddca1939781b929baa40402427c37da2f6e04d9b50a2c3f0f7355bf4fb3c1f2e6cff07e8ca133331cbe79bcbf993fdafa72e1a5b9e39367ad4d73
SSDEEP 192:9a9gFejLVR3DZ+4vuYyQOxNE9dD3LlUMITqYeD30C/QP+wWwo2RZOOP65FGgvI4:sye/bvscPI4
MD5 SHA1 SHA512 SSDEEP

Submit Download

35486637-ae2a-4b4f-92ee-0c6ab8afd587

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\datareporting\glean\pending_pings\35486637-ae2a-4b4f-92ee-0c6ab8afd587
Size 745B
SHA256 3064b3c34dbb96196c74af2476f76c94b936536a4bb25d07c9e3f8033e2ca841
MD5 51d77cd9c8333c87a19c78cb37a78b63
SHA1 e2d95376de07ef3686112df517ee66271da6bb1e
SHA512 18fdab28379d094ff26187544a62883784903235dd666462b1797f3f6f18bf9023e61ada0b73607308418790ff014e7db6784b07f602c114f9ab8023029d8805
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js
Size 7KB
SHA256 767b0cbcf2bf11d7a065e5d2edfe5d05d114a940b86ef0f8fe8c763f06e736a4
MD5 c5f5dff7061b4db5f163a5ab6628e959
SHA1 c670d624288c2507e38935e903cb34e65a737a9c
SHA512 0a330f256784d0d7b38a8eca0dff347a6e5df845b9fe9efcb3ec077c4ecf2edd4257f7ec6a80be312075dd3352256e777f7a450982cd914d1d418478969f21e6
SSDEEP 96:xHD5nUTeqGqPrdbmUeOTzS/PXAnpjuHq26OuUBw8H7RJ:J5nIRjdbmUe1PX9AOfBw8H7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs-1.js
Size 7KB
SHA256 ef1df2d9e0235cb82b47454d06a2c1a43e547bc32305698d7e077c2b41834129
MD5 467b8e4cff6491600a129c232388cca7
SHA1 0b35802b9acf4685c6ac55976d59134653627751
SHA512 4f1baf17bd0f9bd292ab6f414391f2ccd438023d35b07b41e0d34af63ffd50c6d23f341e6c8f777086bc8490b4fcceb5ead45e696c1b3e2686b38ec6306826a3
SSDEEP 96:xHD0nUTeqGqPrdbmUeOTzS/PXAnpjuHq26OuFRBw8H7R6:J0nIRjdbmUe1PX9AO6RBw8H7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js
Size 6KB
SHA256 090ee5e75819a3888281d2750ae2be659ab9500c6b483e0d7535db2791f952a7
MD5 afaba5e1f6c4ab983e3e0d0afc48a0cb
SHA1 ba0877719dfa1ccc9dc283021c8678b4bc7f814a
SHA512 428033a2160b6fdffcc471becb4d2493a28a18fa4b1d4047e5bd3f1b070f0ed6b00abb59a387ab0b8afbbd36715a82a6f53ff0b04bf6a7f75db07aa873c75a34
SSDEEP 96:xHI5nUTeqGqPrdb/9eOTzS/PXAnpjG4Hq26OuZBw8H7RJ:O5nIRjdb/9e1PXsAOSBw8H7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js
Size 6KB
SHA256 63b3431c57975d883c0ece1a9b474b7b78eff1a0f5c569dc9a3f2273308e7803
MD5 4a37ee0b1a8973b830ad280c47c47eba
SHA1 9553fa6d7a6a291b3390cad672c1488ac0db7dca
SHA512 20342a581ef13b8a7ac57e63687d62127dc50e79cbafab93b04487d5e86993a0aef0ee6a59201721caa3b0f0017438183b05da9c168abb97a70c109fd2992322
SSDEEP 96:xHI5nUTeqGqPrdbmUeOTzS/PXAnpjuHq26OuxBw8H7RJ:O5nIRjdbmUe1PX9AOWBw8H7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\prefs.js
Size 6KB
SHA256 9fd54a1552501fc5e929be00e55b2369659a62a41d5c6f0a050629604dbbf9e8
MD5 ae0f44bbb0177b9f3afc8aaa2f9d3797
SHA1 1fa3bb553627559bcf7ab11f493bcf557ad58769
SHA512 b380384b40511ca48a141ea49d0c921c24296e608461b9e60d5f89d8931d50c4d1c5661f0ae1444357f64980adebbf3068877cddd77409080bffc53ad1ff7182
SSDEEP 96:xHI5nUTeqGqPrdb/9eOTzSIPXAnpjG4Hq26OuZBw8V7RJ:O5nIRjdb/9eOPXsAOSBw8V7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\id09dv1m.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 a326ad15a483d99118e785531f7df5cab83ec8cca6a9b4b82e9596ba46d41cb7
MD5 af6556d36da524f0021e6f3cc2b2c16a
SHA1 fc6fffdae5b460fd075be2cd885cd86adf64281c
SHA512 a9d451513d22c000cd2d44643127501f9df2b65a36da03564630e19523732d25ff83f907b9513fda0e2bdfe0b8d0d1b4bafef22dde0adb9186cd5c7502a240b7
SSDEEP 96:6z7A0fInxROflEGJF7GtFM7k0zf8W8Qge3ZwS20X81KTn:WrczYCiFAFM7kcuemgXPTn
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path \ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path \ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2284-142-0x0000000001020000-0x0000000001C0B000-memory.dmp

Download

memory/2284-158-0x0000000001020000-0x0000000001C0B000-memory.dmp

Download

memory/2352-138-0x0000000006CB0000-0x000000000789B000-memory.dmp

Download

memory/2352-409-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-314-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-304-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-323-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-431-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-170-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-139-0x0000000006CB0000-0x000000000789B000-memory.dmp

Download

memory/2352-425-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-424-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-423-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-118-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-422-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-421-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-417-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-305-0x0000000006CB0000-0x000000000789B000-memory.dmp

Download

memory/2352-407-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2352-405-0x0000000000E90000-0x000000000134D000-memory.dmp

Download

memory/2416-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Download

memory/2416-2-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2416-65-0x0000000000E60000-0x0000000001A4B000-memory.dmp

Download

memory/2416-66-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Download

memory/2416-0-0x0000000000E60000-0x0000000001A4B000-memory.dmp

Download

memory/2932-70-0x0000000000A60000-0x0000000000F1D000-memory.dmp

Download

memory/2932-117-0x0000000006C30000-0x00000000070ED000-memory.dmp

Download

memory/2932-116-0x0000000000A60000-0x0000000000F1D000-memory.dmp

Download

memory/2932-303-0x0000000006C30000-0x00000000070ED000-memory.dmp

Download