amadey | 067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
23/07/2024, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
Size 1.8MB
Sample240723-cjanhs1fpf
SHA256 067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2
MD5 1f92795b00fc3b7291b9440c2eb696c0
SHA1 a39390a9b614c9d817d832a84c496c42a0198036
SHA512 ab546f5c4fc97c077f1573fbdb1c6a3d9954805d240269835dca4ad5e7d7dd87062183d4fe1486a83d31e7936508921a49ebf67546b86976ed5596532087a472
SSDEEP 49152:L/mnbR11PZlVADzNtqVf/Mqtkxj8LzFQOmziS/T:LAR1RZ8JtqVfuxAzuOmziSb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d sila evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

sila

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe

Executes dropped EXE 5 IoCs

pid	Process
2788	explorti.exe
1572	d08aa17e0b.exe
3032	6ad5c5f34b.exe
3008	explorti.exe
4356	explorti.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Wine	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000\Software\Microsoft\Windows\CurrentVersion\Run\d08aa17e0b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000021001\\d08aa17e0b.exe"	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aae6-47.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1872	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
2788	explorti.exe
3008	explorti.exe
4356	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2532	1572	WerFault.exe	80

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3766757357-1293853516-507035944-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1872	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
1872	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
2788	explorti.exe
2788	explorti.exe
3008	explorti.exe
3008	explorti.exe
4356	explorti.exe
4356	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1872	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe
3032	6ad5c5f34b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1456	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2788	1872	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe	78
PID 1872 wrote to memory of 2788	1872	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe	78
PID 1872 wrote to memory of 2788	1872	067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe	78
PID 2788 wrote to memory of 2420	2788	explorti.exe	79
PID 2788 wrote to memory of 2420	2788	explorti.exe	79
PID 2788 wrote to memory of 2420	2788	explorti.exe	79
PID 2788 wrote to memory of 1572	2788	explorti.exe	80
PID 2788 wrote to memory of 1572	2788	explorti.exe	80
PID 2788 wrote to memory of 1572	2788	explorti.exe	80
PID 2788 wrote to memory of 3032	2788	explorti.exe	81
PID 2788 wrote to memory of 3032	2788	explorti.exe	81
PID 2788 wrote to memory of 3032	2788	explorti.exe	81
PID 3032 wrote to memory of 3248	3032	6ad5c5f34b.exe	85
PID 3032 wrote to memory of 3248	3032	6ad5c5f34b.exe	85
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 3248 wrote to memory of 1456	3248	firefox.exe	88
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89
PID 1456 wrote to memory of 3212	1456	firefox.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe
"C:\Users\Admin\AppData\Local\Temp\067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
    "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\1000021001\d08aa17e0b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000021001\d08aa17e0b.exe"
    3⤵
    - Executes dropped EXE
    PID:1572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 1324
      4⤵
      Program crash
      PID:2532
- - C:\Users\Admin\AppData\Local\Temp\1000022001\6ad5c5f34b.exe
    "C:\Users\Admin\AppData\Local\Temp\1000022001\6ad5c5f34b.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1456
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1912 -prefMapHandle 1904 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a70c2679-bf06-4bb8-9fc9-22bdc872fa4f} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" gpu
        6⤵
        
        PID:3212
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a430295-4195-4744-bbb9-a6def26461f4} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" socket
        6⤵
        
        PID:2144
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 3016 -prefMapHandle 2984 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d1ed5af-6b4b-44d0-93e0-0e4646adb3c6} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" tab
        6⤵
        
        PID:4988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4012 -childID 2 -isForBrowser -prefsHandle 4036 -prefMapHandle 4032 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa574f02-ded8-4ae6-98bf-18c586abb713} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" tab
        6⤵
        
        PID:4292
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4840 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4900 -prefMapHandle 4896 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75d6af0b-792d-4d81-8f8b-4a2bbdc4c4f6} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" utility
        6⤵
        Checks processor information in registry
        
        PID:32
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 3 -isForBrowser -prefsHandle 5644 -prefMapHandle 5648 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2392003d-4ea3-42d0-a70b-cc498ce9991f} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" tab
        6⤵
        
        PID:3748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 4 -isForBrowser -prefsHandle 5772 -prefMapHandle 5776 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec4354f3-f096-4f1c-8328-6aa3420f0ffe} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" tab
        6⤵
        
        PID:3344
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5932 -childID 5 -isForBrowser -prefsHandle 6032 -prefMapHandle 5940 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fcf8773-e805-44af-8a78-ecb8ba175ea7} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" tab
        6⤵
        
        PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1572 -ip 1572
1⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3008

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yz8w575m.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 4ea8fdb0b3ab83c24b77a4275199a9c39a93aba03e70d0db4939d1b2c65c0e4a
MD5 dc0ee95d4f89611259e4a361d7569205
SHA1 1c3ccd2b272a90b6813b1c4acbb7c300a5777b90
SHA512 2a705d71beaf0df43348f6563b298f88aaf0bc674e467b25d5439aec63f19fc3883f23f37f667cb3245c62fb9c8f6620f0992765a60d3737a22c01f50a0446e2
SSDEEP 384:H485u9fiGLm4pUfft2WlOX8lPLZZB7t0lpDIIwQA:nUBi8mCUfft2WAX8tzB7eD8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

d08aa17e0b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000021001\d08aa17e0b.exe
Size 199KB
SHA256 18b8662e5d0b1f00302bbe26ddb5fa099da34a0d3255180d2358d6066bb42348
MD5 4ee0b6214eb06ae32de0773dc4e5e30a
SHA1 4c1bcf6f93fd67a82d1bac890df32ee82027af32
SHA512 5f2e2cea8ab75c0b2d79b0466531787beb2ca234e7e1b32d505fb61aa5a5843226847874e7ae890cce061b5de40b24567bd9d00a8eec08c827209e375f50aed9
SSDEEP 3072:EeL8OLdNnLtzJm+YVH7o6Y68I4/qW2Hh2GV1Rae5AB6OQQX0I85lT6OcW:vL8+nBuVH7jyIfVvPbJTIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

6ad5c5f34b.exe

Path C:\Users\Admin\AppData\Local\Temp\1000022001\6ad5c5f34b.exe
Size 1.2MB
SHA256 fb88e056a84aca29dd61784fa3d87525528b642a52115df448b3cc71cef61f6c
MD5 6c87f76c8aefb081d356a8f01e05aac1
SHA1 cf3834346e53a7e0376fd74e87407ebaf04d41a0
SHA512 8dc023458d8b9e0e73c14ea643112c042a6b0946a5e33d19d5b81a215c28de5a2a14181f1381e6d495500e5992893955c56e4fbcd6c9ba7ae39d15cef83af1de
SSDEEP 24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aLV2Sbly7TWEPje:CTvC/MTQYxsWR7aLV2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 067ff229884c58ebf87d7519a5cc37ba5d23a14ac02edd77465399f3b98a39e2
MD5 1f92795b00fc3b7291b9440c2eb696c0
SHA1 a39390a9b614c9d817d832a84c496c42a0198036
SHA512 ab546f5c4fc97c077f1573fbdb1c6a3d9954805d240269835dca4ad5e7d7dd87062183d4fe1486a83d31e7936508921a49ebf67546b86976ed5596532087a472
SSDEEP 49152:L/mnbR11PZlVADzNtqVf/Mqtkxj8LzFQOmziS/T:LAR1RZ8JtqVfuxAzuOmziSb
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\AlternateServices.bin
Size 8KB
SHA256 28dd01a2b32c0f73858f473978839e02a77a9978a490d9724b284e65549d1263
MD5 bc08c2e2b801cffe84294f5550d5e33e
SHA1 7a6e3fa182d71256e4c5471cca65ea552f859c8d
SHA512 912da1446f9a83811736dc6c12ce4c65f5251f67dad1858190cae1a920d4078729cce017dbd661c05c3eeaf680388b1e5003ed9d169d193b7275ef67d8a282da
SSDEEP 24:dgu1xgRbXOGpR5cOttuhMZX0uB1osaFsh2F3LFkR9sJbF0JkkbCWKsJblxWKf+kL:d5o6G9cO/ebOJNbCpebvpf+Wb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\AlternateServices.bin
Size 11KB
SHA256 a375b1232130193719d4c1ce10befebee18c9e7085150d0b38ee9a88bd8e1791
MD5 5482ca81b4a57b933cae5044c18a93f3
SHA1 4d4fe08258832f1ff7addd67b63d38343c628de9
SHA512 634ebf45086e15e316f3247d2ed5669f82903a20177e0156bb9c005c7643e1e1b7b273ef93835f9250bdeeaccf1118d82540cddeee6ad2ae061099d0e491727c
SSDEEP 48:ny5oS9cO/ebOJNbPpebvpf+NbEb0bHbbb:y5omebOJNbPpebvpf+NbEb0bHbbb
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\AlternateServices.bin
Size 13KB
SHA256 8e5aef0e5d39179d8a40e54770278f137219d8635fcbae7c715d5034d694474d
MD5 a188be6d06290ad23a7663dad2e9368f
SHA1 431cb6b9e3ea967bac938f252117873b97791da1
SHA512 45126588dd06d0a15fae97e4147ba4be5aa29609eb9bdd6d0b6e1e5d5da1a33d427db790e63eefa8bc8794433ed2822a5006ecbca40956d6b9ad170fb2b27cf3
SSDEEP 96:y5oSebOJNbPpebvpf+NbtbZbIbAbsgbgzKb4bmb:y5pu
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\db\data.safe.tmp
Size 22KB
SHA256 48c9924ef2cc16be51593a2aaa59fd8b0cd848f1da5d14bbae1840c90dbb5392
MD5 2e9062e7c090248c4374bfa23a35f834
SHA1 fcb2bd4678f4a7ceb4339a996c67c4ecff05002a
SHA512 7b70a4303e21c0f0db9550110ff57b2e13423e614a1e7530b10b0ea9ae1f27dbca232c933ec98fa27cdc21a298064296e02c38e88e1c4cec88b024e65104b685
SSDEEP 384:2boOJPW/66JozQzgC1bdtp+6d9+kzK/hZLNYPjvytjLUfTBbdbIbObdbzbbb2bpb:avLmBp+6dwdJZLqPjvytjLUfTBbdbIb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 10b1877b3fe3c8c4ed3605c1b7ded81ee6db924b2458ca5788a497c570d9153e
MD5 2c991e54c06f35a6ee92b7e3c1d998f2
SHA1 2dedc232e0f9bd5fc1d30afe5c56285613c597f6
SHA512 530a4897c32c6f04b7a84e805365a297329efa556c11793e9b67a085ca3f694beca60221eb7bdda328c1fd302761bfa6594d692dbe4578761987205721dbcb09
SSDEEP 768:PbJHobOCraxzDjvXwjLUfiObdbIbsbubzbbb2b073Hjdteimz2l:PbJHoiCra073Hjdteo
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\db\data.safe.tmp
Size 25KB
SHA256 4cf703f5cdb73aaa64916178093c1dbb86d65d255002ca0de322e11fa7539e08
MD5 488dafdf0f51190a6ee3314a9907fce1
SHA1 c80cccf6db830ded075cf0601dd9fe67125a68da
SHA512 a790207434c1838b53c73350efa35bae2354e5b6dfe78d9e908b28d6dd8af644bb4fe4cb3208d24f410b5d24b1e6dcf063b7ab51881a829b0ae90fa2fc78b7ba
SSDEEP 768:Amae+bJHobOCraxzDjvXwjLUfiObdbIbsbubzbbb2b073HjdteE:4bJHoiCra073HjdteE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\db\data.safe.tmp
Size 23KB
SHA256 5af1501aac607e5bc296548a6e59e1fa3da34e63b421fb51cd402c51a6cd4de6
MD5 23e6fd9fa4e85bbcc456e5608407caa9
SHA1 b2f037dc73db672baceaaac7d440e49f3f5a696b
SHA512 12927f4d5e805badcbfc8b458eee6d7c32c0835c819034f59e0fcc3bf433a257abd965d84feceabdb0461e045a85cd5f9b9ecdec47d8316d68c080d685d77e05
SSDEEP 384:N/66JozQzgC1bqboOJPGtp+6d9+kzK/hZLNYPjvytjLUfTBbdbIbObdbzbbb2bpb:AmMvup+6dwdJZLqPjvytjLUfTBbdbIb5
MD5 SHA1 SHA512 SSDEEP

Submit Download

94daeae5-8cb3-41cf-8d37-a00b4140f698

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\pending_pings\94daeae5-8cb3-41cf-8d37-a00b4140f698
Size 659B
SHA256 568a7c0529e7bf6b62f3c727b402f06d4d435da372871e4cd89c08507e4f848e
MD5 4149802094d7bf74fbbe7fccba7fcf9b
SHA1 7e743c88be3a8cc2fe071efbef387a82d70b855c
SHA512 d64112f75ca26d8ea833ead9c6417ead4f4c75664ab7830022bae10a0f0c5e5e64dcee85bb127e5fb9627970000fd5f57419e315d28121ae741b2a08d17e6c4b
MD5 SHA1 SHA512

Submit Download

9865fea7-346d-4ac9-917c-7d0b65375745

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\datareporting\glean\pending_pings\9865fea7-346d-4ac9-917c-7d0b65375745
Size 982B
SHA256 a4d49afd12644987e97b81cd3cf84ba5b72603d4d3f5fc36fe896026d7fdf5f9
MD5 1a573ff151e860d921f2a32ed2355dca
SHA1 a5811b7c93c829623cef43891be8aa9e35bba335
SHA512 c261ec39083d199d8d0a9db9bfc439ac132e8421dfc9962814fbf46389b17e96ba6e47584b91991268112008a46ee08df72d522e5ed39be24416c98a187bc9c1
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\prefs-1.js
Size 13KB
SHA256 64a3a95dcd9035f12e83315d651de738639cb82a03bf88c15e750e872f77798b
MD5 03d73998f809426a7125f7716783538c
SHA1 89b469edba0daef8b6e1241428fdd28b3286da29
SHA512 bc6c4893382adfd024f58fbedb4ae783162bbdf7da16a1618420427feb1f04e16d0150ba082bbfe4f84ed0ef086937f7c033c64dc722adfea5815aab5c0d3b07
SSDEEP 192:6y5nhQRbfHrddZYfY2d37W+ltcd2YAdgdek1I0X60OaXCtGOWTBw8HO8:Fk6fN7W+UQ6Cds3w+
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\prefs-1.js
Size 16KB
SHA256 f09a8e795107985fbcf6fdd3c43e6f06ef8cc5f5d659b262a5f2e6d985e75c94
MD5 02e1db838d3a78b9c5cd2086685f1600
SHA1 f8dd3656aa87dbd760f8558724be6d119e3be8c2
SHA512 3739c1176ae25c1dc45072dd606b062cde3a676a536f2a58e15c2f30d1f4515f5ba431c2ed657e3348b89f4ca352a4680bc00c31d0bea5534f66f7ad0518c91b
SSDEEP 192:6yOnhQRbfWrddZYfY2d37W+ltcd2YAdgdek1I0X60OaXu+tGOWviBw8Haz3RK7:KkVfN7W+UQ6Cus6wXK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yz8w575m.default-release\prefs.js
Size 8KB
SHA256 1dcf1a3b2b38464b40694abcfa6f35ed46c3a6601454f1232ef64f355644878b
MD5 ef8d4bdf10ec196020583ce1be96c227
SHA1 6f85a4203d346d181de3b27b226aa10821978bf3
SHA512 b0150142627d9f171cf8ff500fbe806ef37b47afc30f7ef54c9d8e8c604853e103976013f5ba05b5b7d72bc7921307ed0177eebd6811bbfcaf193e668469a04f
SSDEEP 192:Cy5nhQRbfHUbkwhilcdVBA60KaXbtGOWsBw8VY:dkv+FnR4s8wf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1572-40-0x0000000000790000-0x0000000000890000-memory.dmp

Download

memory/1572-61-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1572-41-0x0000000000AB0000-0x0000000000AE0000-memory.dmp

Download

memory/1572-42-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1872-18-0x0000000000060000-0x0000000000513000-memory.dmp

Download

memory/1872-5-0x0000000000060000-0x0000000000513000-memory.dmp

Download

memory/1872-0-0x0000000000060000-0x0000000000513000-memory.dmp

Download

memory/1872-3-0x0000000000060000-0x0000000000513000-memory.dmp

Download

memory/1872-2-0x0000000000061000-0x000000000008F000-memory.dmp

Download

memory/1872-1-0x0000000076F66000-0x0000000076F68000-memory.dmp

Download

memory/2788-395-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2584-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-394-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-385-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-376-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-21-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-19-0x0000000000B71000-0x0000000000B9F000-memory.dmp

Download

memory/2788-20-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-16-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-1223-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2571-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2598-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2597-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2575-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2581-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2583-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-400-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2585-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2586-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/2788-2588-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/3008-2574-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/3008-2573-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/4356-2589-0x0000000000B70000-0x0000000001023000-memory.dmp

Download

memory/4356-2591-0x0000000000B70000-0x0000000001023000-memory.dmp

Download