amadey | ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20/07/2024, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
Size 1.8MB
Sample240720-hapzqszgkq
SHA256 ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a
MD5 4be92cfe9e6fffa2d34a959a588d7709
SHA1 87e7313b81cba4340882d664524dbb929b8208bf
SHA512 7a894758662b056c4ccaf7b92837ceceed0137177782ab6e9cecebf0f3418c3f8b6d9601235b0926d0d028707be507340f3f5250d9cc19d0c607d509b2d99a3c
SSDEEP 49152:mfnoW6BtsPqDf4G5FZj+4Rq6HJI2rsODIyuOAYnXDfBdDkD:mvT6BtZso7jpa2rsODoYnzbD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d default evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 5 IoCs

pid	Process
108	explorti.exe
728	d9d4ef54b1.exe
4476	b2dfd7ed06.exe
4052	explorti.exe
6132	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Microsoft\Windows\CurrentVersion\Run\d9d4ef54b1.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000015001\\d9d4ef54b1.exe"	explorti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Microsoft\Windows\CurrentVersion\Run\b2dfd7ed06.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\b2dfd7ed06.exe"	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa81-46.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1980	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
108	explorti.exe
4052	explorti.exe
6132	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1980	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
1980	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
108	explorti.exe
108	explorti.exe
4052	explorti.exe
4052	explorti.exe
6132	explorti.exe
6132	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	firefox.exe
Token: SeDebugPrivilege	4344	firefox.exe
Token: SeDebugPrivilege	4344	firefox.exe
Token: SeDebugPrivilege	4344	firefox.exe
Token: SeDebugPrivilege	4344	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1980	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4476	b2dfd7ed06.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4344	firefox.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe
4476	b2dfd7ed06.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
728	d9d4ef54b1.exe
4344	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 108	1980	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe	82
PID 1980 wrote to memory of 108	1980	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe	82
PID 1980 wrote to memory of 108	1980	ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe	82
PID 108 wrote to memory of 728	108	explorti.exe	83
PID 108 wrote to memory of 728	108	explorti.exe	83
PID 108 wrote to memory of 728	108	explorti.exe	83
PID 108 wrote to memory of 4476	108	explorti.exe	84
PID 108 wrote to memory of 4476	108	explorti.exe	84
PID 108 wrote to memory of 4476	108	explorti.exe	84
PID 4476 wrote to memory of 640	4476	b2dfd7ed06.exe	85
PID 4476 wrote to memory of 640	4476	b2dfd7ed06.exe	85
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 640 wrote to memory of 4344	640	firefox.exe	88
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89
PID 4344 wrote to memory of 3032	4344	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe
"C:\Users\Admin\AppData\Local\Temp\ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Users\Admin\AppData\Local\Temp\1000015001\d9d4ef54b1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000015001\d9d4ef54b1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:728
- - C:\Users\Admin\AppData\Local\Temp\1000016001\b2dfd7ed06.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\b2dfd7ed06.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:640
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4344
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1976 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff3f003f-3e06-4c20-ada4-0dc60ccc8a89} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" gpu
        6⤵
        
        PID:3032
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {45e67536-25fe-4f27-83ca-c9ed42a58e83} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" socket
        6⤵
        
        PID:3848
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3308 -childID 1 -isForBrowser -prefsHandle 2840 -prefMapHandle 2824 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22209d1f-0dfc-4f79-96d3-0075f564fae0} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" tab
        6⤵
        
        PID:3768
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3804 -childID 2 -isForBrowser -prefsHandle 3120 -prefMapHandle 3624 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {196209c6-19f3-4193-a7ac-3a2c266e31d3} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" tab
        6⤵
        
        PID:4400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4764 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4760 -prefMapHandle 4756 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7ea2858-4fef-4606-b139-1557e3025ade} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" utility
        6⤵
        Checks processor information in registry
        
        PID:1328
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5800 -childID 3 -isForBrowser -prefsHandle 5792 -prefMapHandle 5788 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a72db07-3140-4a2f-9bb6-32329a743379} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" tab
        6⤵
        
        PID:6092
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5816 -childID 4 -isForBrowser -prefsHandle 5692 -prefMapHandle 5764 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f0d67ae-983b-4b04-9a6a-f623deba3a6c} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" tab
        6⤵
        
        PID:6104
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5764 -childID 5 -isForBrowser -prefsHandle 6112 -prefMapHandle 6116 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {992eb70c-3765-4cb2-80ac-db2f5a0f78a9} 4344 "\\.\pipe\gecko-crash-server-pipe.4344" tab
        6⤵
        
        PID:4296

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4052

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\activity-stream.discovery_stream.json
Size 24KB
SHA256 6390ca9e87a408ef01f052cc4b9ba74c76abd1dab9ae8674e0efa5e2ceeb93de
MD5 7b0b53721593f0c9ea67bc51474bd4c8
SHA1 b50d3c1be72fac8392c71b6e83666c3bf821c0ac
SHA512 d44c534ef8b45e6c45ec32cff5ce017b2d78d47ce2227dd31357a96d1cf7cf893f9cb78f6ec4899fc768dda6c58816486a2fa97349a3a602a076003e6c5dc9ea
SSDEEP 384:XCY6Jt7XYhgM2Zv0M0fGmTHqJNZpc1Vc2Z5C3bkbiPyauhe9e9glcf9P5:XCY6X42NnmMN3e43nPydhWWgCVP5
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 8b74aae767bab1d6243492354e38adaa25c7f4978d9c88ed38d915b849297129
MD5 084b2667acb93f4dc0d3864c1192296c
SHA1 3b37c2448d1354aaef2493f0382f32f0ef2b4d60
SHA512 d83de94b28281e1f66a705b6d5bcbc152d809969e38aa64de41258f2f113322efea6d79b65449291c7ba6475f03665e95cf45b4d89f2802d87ff73c97336d14f
SSDEEP 384:H485u9fiGLm4pUYft2WlOX8lPLZZB7t0lpDIIrSp:nUBi8mCUYft2WAX8tzB7eD8j
MD5 SHA1 SHA512 SSDEEP

Submit Download

d9d4ef54b1.exe

Path C:\Users\Admin\AppData\Local\Temp\1000015001\d9d4ef54b1.exe
Size 678KB
SHA256 a4e51ce0f2bcb0159ce826e68319a9387660406b965727c473d6603a2615daa7
MD5 677fd746b6e6c0b111f9b4377edfadbc
SHA1 a8beb826cf6692072400134343044846deeb81ea
SHA512 e3f3ebde6af7af10f21fc162b117953dba0fa21b9063a378f7ab12452bec4a1ca1d069a56f8cd8d64b3baa8e1e6be0f34455132898117e78d0bba5bc1e34594d
SSDEEP 12288:CV1/qg1o7YNQB1F85ZwKd89BcFE/kJGi1qdDNnSr3/35ellbLd1X2weFx8:Cb/qg2wQ3yEvOHJudDNnQ3v0lgwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

b2dfd7ed06.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\b2dfd7ed06.exe
Size 1.2MB
SHA256 f7b04796db2c4c83204a194936cd0862d69073f075cec7ca21e7f41c48673df4
MD5 2eb2ef6ce0c74824f0f7bcd54204bfa4
SHA1 be5a7de0c6770bd009bc8b06c7106bbd9afffcb3
SHA512 4917f2b944313fabcb7993073e328c4e6b48357c863e373143341d62d61db011057b35b5b0be929c5b871a2b23d67b340fbe0bb7f89ac25a3f861d44ccc9ab80
SSDEEP 24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8aLu2Sbly7TWEPje:aTvC/MTQYxsWR7aLu2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 ddcdfeac7ea5ee59db8aefb00c1c5ce2c079a903273685d3b25ec2214ae8962a
MD5 4be92cfe9e6fffa2d34a959a588d7709
SHA1 87e7313b81cba4340882d664524dbb929b8208bf
SHA512 7a894758662b056c4ccaf7b92837ceceed0137177782ab6e9cecebf0f3418c3f8b6d9601235b0926d0d028707be507340f3f5250d9cc19d0c607d509b2d99a3c
SSDEEP 49152:mfnoW6BtsPqDf4G5FZj+4Rq6HJI2rsODIyuOAYnXDfBdDkD:mvT6BtZso7jpa2rsODoYnzbD
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 17KB
SHA256 7bc40b986aa7fbac10f9312cc7727d64a64a78f19c5ec5ad285387f7d8c9c23b
MD5 0fb304e7ed7e8e6b8bf9d64b82aa75cd
SHA1 cbc6e6b2aeb48bb7fab544ef0ba0bbafbf237638
SHA512 b6bd2b21d75caa194b1ce15abfc891ed82652ab55000f351878f9d0cd5f52754398d1b7d07847edbeb7154e49cc9210ff0c853cb60dd39b5515669b0dbb738a7
SSDEEP 96:x5o3+ebOJsbRpebvpf+7bYgbgzCbwbsbrbrbub0b6HVpbIb:x5Eu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 7KB
SHA256 550a901417897c9f9cad3f47ffa336f5165930b7a4b0edbdfd17ed0449a83073
MD5 dcc7a429c964f419591b355efdbe9be2
SHA1 eafe363dbff314223c64bc36eb76476973384b41
SHA512 5737217972ea396ea161323994dee1c9f70e16ced57b47c5fd119839d15a286e3366fde13d485c84612456d6e38c15318d5bf92cc1c69e790bf6c69b4dc08f1a
SSDEEP 24:RuB1oVpR5cOjfDIgu1xgRbeuhMZCMFsh2F3LFk/cn/sJbF0Jk/+b:p9cOjf05or4/ebOJnb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 8KB
SHA256 e7a551c40febed9be6dd99c053925f2fe5ed728e11775d849beb92c93582704a
MD5 a7505b6c5fd13ae22f6af2fc6d414c96
SHA1 c2f833aaec8fd639772440d7bd5ecaa645df3cce
SHA512 57a1c0cc7c27430c8f56f64a9cd38dda120e3f5c4b0d514dff554a629795d773bb9fb74075b600141dffeef8b1c89b57524906164aa65f934eb2d8ad2455deca
SSDEEP 24:RuB1ohpR5cO//Fgu1xgRb2/2uhMZCMFsh2F3LFk/c+sJbF0Jk/NboWKsJblxWKfT:t9cOV5oq4+ebOJsbopebvpf+sb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 12KB
SHA256 4262c0905c1a4fedc59aca92c670bfb55bc1849848944d86179daf2e6eec6995
MD5 bfbfc39b4fc0cf814ce0ed4c3d4add5f
SHA1 f5d1b650024fa9fffa8b6d78680b825a7e2a0e0d
SHA512 8bbd07a98a3c148eb5848cb2ef15f240eae64f2d16d1f9b66b5a723e75033ae92ba666e53807accebc2bf1457255e1a1feefab3ecf2a1ba5e45a4ed2da0b4d21
SSDEEP 96:F5o3+ebOJsbopebvpf+sbYgbgzCbwbsbnbDb:F5tu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 a3780a5ffe3add76097ae168c6af363f3f1a297ac176528fab2e2a7bec8cd2a9
MD5 2164ae2114609a64198f3fed8ff2f012
SHA1 9332b2ea317d3b36258b1386c92598f1504c2d9f
SHA512 bf2c66004cedb8311009dab4a93a27b7ca52796254e84c96e0cb0247c186af4b0fbf66be8c604ed95e085b55031ef47f6f11672ec621076b6a750a1ee5aaf9b3
SSDEEP 96:b4nQqi09Fl66Joz0dzgClKtmSSkB5SMF9ZbkW6QX0BBahmHDPP/PrWZ:E/66Joz0dzgCl6mSS2rvZboHah2LPC
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 1cc637ada343e474d3ea51f5004b78fe44c0fb0d0cc216ee1c943eaafe784b3b
MD5 41a7b8a59ad854f991c0aa897375bc17
SHA1 710a6b244d989fbea3c74f05f8b77825902ede56
SHA512 2bd1a1c0c78b3fc09a8356484355010ac688dbcac9f0f75241d5596968fc2ae9b9501897c84b73c533097d4259c19d0dcc5a9907b378b0d0e5bc49bc36b0e31e
SSDEEP 384:s3F//sg8Dk6kFbIb74bo6pbPb/66JozQzgC1bM:OcrDk6kFbIb7QT+mm
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 0aa97ce97958207517127eb2d36de2f10ece0d18349ce84ac4f0c60f23640e90
MD5 c766a0be295148183998ead1c57e51bb
SHA1 b6e59ad2b9247c5998fcca9d603dc58437000f21
SHA512 86fd21f3fd558d4cb0acf075434c844e474584a3b650fcc33fbc48671f4305dd1fab9140e58a9c9132b524719ee6fded0d75bee09b2cddd0ec706ccd8cc8df1d
SSDEEP 96:J1B5SMF9ZbkW6QX0BBahmHDPP/PhxkWg4nQqi09Fl66Joz0dzgClKtmSSM:XrvZboHah2LPDfB/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

7bf9d4da-6f2d-4fa6-abec-dc714831dcf9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\7bf9d4da-6f2d-4fa6-abec-dc714831dcf9
Size 982B
SHA256 72c564b54929e2b4e6915df599b5d41ae8d458d884d461cc5e344e77c0c7d496
MD5 fda900fb5db53097cc6d3e525cabf1ed
SHA1 2f1fc55d03ae1e36dcc8db195399c3c5f29cd98b
SHA512 33c86054308db8800dac23ca4b413e55cd675a8f00345683f9a21aa8b3bbb8137b845dfc025a45c3b90196b8980e05b178f989a3e21af353176eefb5f79428b7
MD5 SHA1 SHA512

Submit Download

8fd18d2c-40db-401e-9fa9-2e4e646ba7a9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\8fd18d2c-40db-401e-9fa9-2e4e646ba7a9
Size 671B
SHA256 381c4b3760815317e85ad925003d18d3f21f576d8b35feef2eefd1aad4c755b3
MD5 505ce7c7e3661ac77b437e5ffa47d9ee
SHA1 aab4508b62f62ee014999424f358be843d52c78f
SHA512 ff242c6c63b36a4582324f4c3e8c5dee35e334e8ac56685d67b26cfd54400df1a087e075c1e2976eb8a47dbdc8b64df68305e717e8ad68004f31e002e015cee5
MD5 SHA1 SHA512

Submit Download

c401995b-e7ef-4e3a-8104-77bd05f5d771

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\c401995b-e7ef-4e3a-8104-77bd05f5d771
Size 25KB
SHA256 b0de5f5723012bf651a80b507a201695eec1653f865af2c923838df125e904e3
MD5 20708ec0da9432deb391a54b4858af93
SHA1 fab5cca68d0128009aedf9527a3f21e2ab4fb535
SHA512 383e2b759b623a8132b0b834303a7667e66847376667e5f52f93606dc04f00a52592c22b9946784c0f6628c1de9305285db7a0cfa428db6ddfbd15d7977a2036
SSDEEP 192:mJTzfiGbJEZF72VGEHPFmJrAfbla8cjUlSo/7Gb40QgxSIaEq4eGgR78J/N3xoPS:mJTjiGbC72AeP5nrSblQP+wyTIFL0
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 16KB
SHA256 8596b71f4aea076ce0e1cd1a4b053069a8f02636f87e5467f98f99817f829ca5
MD5 5b4b1d0094b3c91e13fb4f7a96947ae0
SHA1 92a909e10f4bb1738e235ef7b7eab2075477296f
SHA512 e50b510fe9501a6e83077513f056ff22cd1533e9a649a6b56f73443caca2283c85f4e9b7f2fc47eaad9ad807babc8bef69d9bc29716964fb72f888cdd6191246
SSDEEP 192:UynKRJfReiV8z7yB15cdlzAcaQHrS60TaXK+hs7wiBw8He1Rts77:Wf8z7D7ztaQLRN2/w5+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 12KB
SHA256 a6446bb27f6d234b2fd054648fe0b988c9a13d765db19384561ff74cd10f5b23
MD5 f57bebda20895d319ef32a37d291c421
SHA1 a250b66110fe453bfa00cbfcdec2f069e266d45d
SHA512 92cac9555de8192bf5e5f8eeb887afea2b56b47d5e89ad9214fdd4ad167867afd9042a995d8622324fe55c3af180c2ba119ca6ac71e6915173bfc1de07ce7cc9
SSDEEP 192:U5nKRJfKeiV8z7yB15cdlzAcaQHrS60TaXOhs7YBw8Hew:Ry8z7D7ztaQLRQ26wC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/108-18-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2570-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-385-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-402-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-403-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-404-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-405-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-410-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2564-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2569-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2557-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-20-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-19-0x0000000000FD1000-0x0000000000FFF000-memory.dmp

Download

memory/108-2578-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2581-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-21-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-22-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2565-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-1145-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2563-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2561-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/108-2554-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/728-38-0x0000000000140000-0x0000000000718000-memory.dmp

Download

memory/728-41-0x0000000000140000-0x0000000000718000-memory.dmp

Download

memory/1980-0-0x0000000000EA0000-0x000000000135A000-memory.dmp

Download

memory/1980-17-0x0000000000EA0000-0x000000000135A000-memory.dmp

Download

memory/1980-5-0x0000000000EA0000-0x000000000135A000-memory.dmp

Download

memory/1980-3-0x0000000000EA0000-0x000000000135A000-memory.dmp

Download

memory/1980-2-0x0000000000EA1000-0x0000000000ECF000-memory.dmp

Download

memory/1980-1-0x0000000077A86000-0x0000000077A88000-memory.dmp

Download

memory/4052-1806-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/4052-1615-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/6132-2567-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download

memory/6132-2568-0x0000000000FD0000-0x000000000148A000-memory.dmp

Download