amadey | 41f7ad8ab71a3ee5cd55c45eefb702a54ef97f3215d882a02f4a660992ff1105

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
85628a07cd947599af6a77d44b3a3ee4.exe
Size 1.8MB
Sample240805-ejg4pszfqg
SHA256 41f7ad8ab71a3ee5cd55c45eefb702a54ef97f3215d882a02f4a660992ff1105
MD5 85628a07cd947599af6a77d44b3a3ee4
SHA1 d933f64448d7b5b68b07bc3d767ae1b118daee0f
SHA512 27421fa8cc0b25ce9d9b41830bfee8f177b93c6dcda94a71ef13abee6acbffea70725056b3211ea3364fd3879948c87ab718ac5842aab7f9a7c6417a5c9ae500
SSDEEP 49152:th4yMpJ/CqdBWgtV/WLatpQatQnCgfNtkrfb4g:DrMr/CiWgt0Ls/Qn9Fs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 0657d1 default credential_access discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

0657d1

http://185.215.113.19

Attributes

install_dir
0d8f5eb8a7
install_file
explorti.exe
strings_key
6c55a5f34bb433fbd933a168577b1838
url_paths
/Vi9leo/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

http://185.215.113.24

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	85628a07cd947599af6a77d44b3a3ee4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	85628a07cd947599af6a77d44b3a3ee4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	85628a07cd947599af6a77d44b3a3ee4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 4 IoCs

pid	Process
2164	explorti.exe
1400	explorti.exe
2956	63cdf2910d.exe
1208	a04ca07238.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Wine	85628a07cd947599af6a77d44b3a3ee4.exe

Loads dropped DLL 5 IoCs

pid	Process
2452	85628a07cd947599af6a77d44b3a3ee4.exe
2164	explorti.exe
2164	explorti.exe
2164	explorti.exe
2164	explorti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\63cdf2910d.exe = "C:\\Users\\Admin\\1000029002\\63cdf2910d.exe"	explorti.exe

AutoIT Executable 14 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1208-232-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-248-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-249-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-256-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-345-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-348-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-351-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-364-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-366-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-368-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-379-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-381-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-383-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe
behavioral1/memory/1208-390-0x0000000000BA0000-0x000000000168F000-memory.dmp	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs

pid	Process
2452	85628a07cd947599af6a77d44b3a3ee4.exe
2164	explorti.exe
1400	explorti.exe
2956	63cdf2910d.exe
2956	63cdf2910d.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2164 set thread context of 1400	2164	explorti.exe	31

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	85628a07cd947599af6a77d44b3a3ee4.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	85628a07cd947599af6a77d44b3a3ee4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorti.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63cdf2910d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a04ca07238.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2452	85628a07cd947599af6a77d44b3a3ee4.exe
2164	explorti.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	firefox.exe
Token: SeDebugPrivilege	2464	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2452	85628a07cd947599af6a77d44b3a3ee4.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
2464	firefox.exe
2464	firefox.exe
2464	firefox.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe
1208	a04ca07238.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1400	explorti.exe
2956	63cdf2910d.exe
1208	a04ca07238.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2452 wrote to memory of 2164	2452	85628a07cd947599af6a77d44b3a3ee4.exe	29
PID 2452 wrote to memory of 2164	2452	85628a07cd947599af6a77d44b3a3ee4.exe	29
PID 2452 wrote to memory of 2164	2452	85628a07cd947599af6a77d44b3a3ee4.exe	29
PID 2452 wrote to memory of 2164	2452	85628a07cd947599af6a77d44b3a3ee4.exe	29
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 1400	2164	explorti.exe	31
PID 2164 wrote to memory of 2956	2164	explorti.exe	32
PID 2164 wrote to memory of 2956	2164	explorti.exe	32
PID 2164 wrote to memory of 2956	2164	explorti.exe	32
PID 2164 wrote to memory of 2956	2164	explorti.exe	32
PID 2164 wrote to memory of 1208	2164	explorti.exe	33
PID 2164 wrote to memory of 1208	2164	explorti.exe	33
PID 2164 wrote to memory of 1208	2164	explorti.exe	33
PID 2164 wrote to memory of 1208	2164	explorti.exe	33
PID 1208 wrote to memory of 1724	1208	a04ca07238.exe	34
PID 1208 wrote to memory of 1724	1208	a04ca07238.exe	34
PID 1208 wrote to memory of 1724	1208	a04ca07238.exe	34
PID 1208 wrote to memory of 1724	1208	a04ca07238.exe	34
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 1724 wrote to memory of 2464	1724	firefox.exe	35
PID 2464 wrote to memory of 1512	2464	firefox.exe	36
PID 2464 wrote to memory of 1512	2464	firefox.exe	36
PID 2464 wrote to memory of 1512	2464	firefox.exe	36
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37
PID 2464 wrote to memory of 236	2464	firefox.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\85628a07cd947599af6a77d44b3a3ee4.exe
"C:\Users\Admin\AppData\Local\Temp\85628a07cd947599af6a77d44b3a3ee4.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2452
- C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
    "C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1400
- - C:\Users\Admin\1000029002\63cdf2910d.exe
    "C:\Users\Admin\1000029002\63cdf2910d.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\1000033001\a04ca07238.exe
    "C:\Users\Admin\AppData\Local\Temp\1000033001\a04ca07238.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com/signinoptions/password
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.0.339642552\373813634" -parentBuildID 20221007134813 -prefsHandle 1232 -prefMapHandle 1224 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {38668049-de4b-4a0d-8d42-aef2da032380} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 1296 10cf6e58 gpu
        6⤵
        
        PID:1512
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.1.397816946\1692109135" -parentBuildID 20221007134813 -prefsHandle 1500 -prefMapHandle 1496 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6dd885ec-b0f5-40c7-a7e6-ce096983b567} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 1512 e73358 socket
        6⤵
        
        PID:236
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.2.819799528\1712510526" -childID 1 -isForBrowser -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a09370a-c11b-4172-857b-01a4b6b31e42} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 2116 19cab458 tab
        6⤵
        
        PID:1508
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.3.524213337\498789299" -childID 2 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcebdf67-2f36-4bb0-8859-6763c9482961} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 2992 e2f858 tab
        6⤵
        
        PID:2748
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.4.586319413\42152" -childID 3 -isForBrowser -prefsHandle 3792 -prefMapHandle 3560 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {52f2a145-63f8-45dd-b286-0847fe405815} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 3804 1e53df58 tab
        6⤵
        
        PID:1980
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.5.1813608789\1365782079" -childID 4 -isForBrowser -prefsHandle 3932 -prefMapHandle 3936 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {617f2f64-8cad-4490-82fa-40b39654425e} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 3920 1e53c758 tab
        6⤵
        
        PID:1116
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.6.1013303925\867755595" -childID 5 -isForBrowser -prefsHandle 4084 -prefMapHandle 4088 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2f2b6e1-e7c2-4552-8bf9-ffdfdb2abbc2} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 4036 1f507658 tab
        6⤵
        
        PID:2984
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2464.7.1390679244\263764483" -childID 6 -isForBrowser -prefsHandle 4164 -prefMapHandle 4112 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89bd0f21-aa03-439a-bcd5-611c481af8c8} 2464 "\\.\pipe\gecko-crash-server-pipe.2464" 4152 2125bd58 tab
        6⤵
        
        PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

63cdf2910d.exe

Path C:\Users\Admin\1000029002\63cdf2910d.exe
Size 2.5MB
SHA256 1cffa63ac6e875c75b6fad6f110d77860b23f96a41283845b477fd3fda349176
MD5 5b82b61104953ce087a22813915c10a2
SHA1 953892ed733c7f25bed30a3464ca45a88afd33e6
SHA512 93128a47ebe498f69a2a2051a43086ef68ed2817de3a499033064bf3bb9aab756ea947475380cb613498db9c7c37155b09cb4c1bdcbf02857da1131139c301cb
SSDEEP 49152:jr6xCIcg1T+dBgH4LFZPfsKglKzeSk+3G8QQcN8JAtppE+tB9uM5dzN8/ooNeugz:i+g1TkeH4ZcKAKeSk+3G8Q18u0+f9uMu
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\pzuz3epu.default-release\activity-stream.discovery_stream.json.tmp
Size 28KB
SHA256 837fad832a74ec1ba25601a96570f9903b1e2c29ec089ab3fe692ee89b42a5b4
MD5 322cda9d1c66b45103aa7066140f71ed
SHA1 3407264149804a5663f08b62220dc6f199d8c148
SHA512 6dbbd560f600d20d05a5c41eb0eb97dc378f20397ff3f2b28384534d08dc1f0490a6c13b85c7b8000b87e3241abc995fdbdef64e91999b85573b9ec190fb93a7
SSDEEP 384:zR5OuzoRjtYGE2lAI5XoKrcqhm8OBhpjKUUyau34HUL4HUULeL4HGp4HG6c:zRAJVlOqsB/WydyUuUULbGgG6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\0d8f5eb8a7\explorti.exe
Size 1.8MB
SHA256 41f7ad8ab71a3ee5cd55c45eefb702a54ef97f3215d882a02f4a660992ff1105
MD5 85628a07cd947599af6a77d44b3a3ee4
SHA1 d933f64448d7b5b68b07bc3d767ae1b118daee0f
SHA512 27421fa8cc0b25ce9d9b41830bfee8f177b93c6dcda94a71ef13abee6acbffea70725056b3211ea3364fd3879948c87ab718ac5842aab7f9a7c6417a5c9ae500
SSDEEP 49152:th4yMpJ/CqdBWgtV/WLatpQatQnCgfNtkrfb4g:DrMr/CiWgt0Ls/Qn9Fs
MD5 SHA1 SHA512 SSDEEP

Submit Download

a04ca07238.exe

Path C:\Users\Admin\AppData\Local\Temp\1000033001\a04ca07238.exe
Size 3.1MB
SHA256 828496c1c3f71cf32682b3c1f2c8562cb6a2421d8be24e68cd0481eca569b47f
MD5 eb3bfbf3b50d0c7962bae59068e66c72
SHA1 4528e816fec35aa9afeec699e65343d7bbfd13e8
SHA512 6c08d903349bad1dc8ccdbaf3784344d9c84204cba965c04ba08cf49c736c2cd4056e0d7899064de4abcd1dcc91ecd79dee7010d17ba927c10d75ad259724c7e
SSDEEP 98304:YLpUUNwc8XJyQZpl7cOuMjPsi8BgVvzdfok:8iUig4lppP8BgN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 8.0MB
SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
MD5 a01c5ecd6108350ae23d2cddf0e77c17
SHA1 c6ac28a2cd979f1f9a75d56271821d5ff665e2b6
SHA512 b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72
SSDEEP 196608:945hXmP7/cvflwtf0FzVC/5lHevzc8XZbivwEiw3cFTx7z4zV:9tP7/cvflof0FzVgKRF9zw3c9x4zV
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\datareporting\glean\db\data.safe.bin
Size 9KB
SHA256 3ce1b4fe79777d0b9d0914529dee049633659f5ee738ebbb956ca5a38493d1cd
MD5 5c7e25cbc52d057e2e0dbce95ac68821
SHA1 5164d2382639507b7fa0d8bc67abb7fb7c9d51f1
SHA512 1bcce6354bb5640349c3ac005c0343c1418ec66845dbfbc5c19190fea9d3cd0dcd537d1033cd0da5b27f31a289ba950580a37928694f437c1240692f466e4a52
SSDEEP 192:A2vTbt/J5o0LiVi3PnSzjXd2QuSebMbUb9bFbc8bJbqbFnG5MEKzh:Fbt/JWi3PnSzjXd2QuXbMbUb9bFbc8bQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

57e55374-c228-467f-a7ae-78d3b6b89c47

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\datareporting\glean\pending_pings\57e55374-c228-467f-a7ae-78d3b6b89c47
Size 733B
SHA256 33370209cb8ad7f943536196ad1a5e87a49895f76fdd4ff4483df0d482d26251
MD5 984338f4017b2f9297ca7c9cca097b90
SHA1 0fcbf61621a2cce897997ffe279061a0c478b16c
SHA512 28e8b9845b7460eda073ea5924f15cb232ea7f7e1316205340bdfd6eeadcd7b661a8f6e249b4effb277cdd75ee5c69e7966a50e4f1f71c693f6f36e20fc3f0ca
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
Size 479B
SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
MD5 49ddb419d96dceb9069018535fb2e2fc
SHA1 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6
SHA512 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
Size 372B
SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
MD5 8be33af717bb1b67fbd61c3f4b807e9e
SHA1 7cf17656d174d951957ff36810e874a134dd49e0
SHA512 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
Size 11.8MB
SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
MD5 33bf7b0439480effb9fb212efce87b13
SHA1 cee50f2745edc6dc291887b6075ca64d716f495a
SHA512 d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275
SSDEEP 196608:lP4/vkvbdjMq4ytbko4qIUcXkhrVp1HSTDsoTn90lcGeFaxJI3qLaLhFT7Uc:lPcvyiXSWxRU/OpZXJFee3qGhFMc
MD5 SHA1 SHA512 SSDEEP

Submit Download

widevinecdm.dll.lib

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
Size 1KB
SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
MD5 688bed3676d2104e7f17ae1cd2c59404
SHA1 952b2cdf783ac72fcb98338723e9afd38d47ad8e
SHA512 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll.sig

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
Size 1KB
SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
MD5 937326fead5fd401f6cca9118bd9ade9
SHA1 4526a57d4ae14ed29b37632c72aef3c408189d91
SHA512 b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs-1.js
Size 7KB
SHA256 654ba9e2a5a3bfeb34140247b693fc3f057ba7fa00ca7eb56924a025715718e7
MD5 51836987f63a0bf8600eef78352b0a64
SHA1 9b66d30f6977ef2e150f2c66dfe449d8bfbd90ec
SHA512 389f1cb60317242e48d899b28ebd6f49c57ed05fdde11185d86814c3c49fe76c1323e824cb0a2bf9716df4a1f336d30af9d5a9c761d1c29ca172a9312f4cfc0d
SSDEEP 96:xH485nUTeqGq8CdwQhBJOweOTzSmPXAnpj3HDZnpGi5Bw8H2Q:95nIRDdwQhBJOwe8PX27Gi5Bw8Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs-1.js
Size 7KB
SHA256 f2d8803d7e420afccf63d647b0c83d18c2fc1d15eb1de93a172d5bf85a12509c
MD5 380d20001f5ce099b7949a4f16fa28d9
SHA1 63a5bc96ba42cad8fd10e674eed7b2d93063a8c8
SHA512 c0b0fadfcbd3598dbeaa8dcbc452b74650a826dd41b7569fd3678116c238145af60950fadff48f9035eb9968147fe62e0ef23d674797e0d384b1961e79f682c2
SSDEEP 96:xH485nUTeqGq8CdwQhBJOweOTzSmPXAnpj3HDZnpGiURBw8H24:95nIRDdwQhBJOwe8PX27GiURBw8HT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs-1.js
Size 6KB
SHA256 2e2069067da7cdc2174e8d8bdcadc91c73246413dd197bbdfb9b5deca2e9f9db
MD5 912dfcedd56dd8fb4513be13fedea4c9
SHA1 d1167cea5bd3b9a41493b458fd42594c8b0b0f92
SHA512 3b5298ed8b97e33cb89903fb94c103258e35d44e7bcda1df5bd38d2fef75a9e5d2f5eff5529ebf871830f7901228c5e8ee7b5083121fdd17aed63a8f5fa7b0c6
SSDEEP 96:xHY85nUTeqGq8CdwQhBJOweOTzSmPXAnpj3HDZnpGidBw8H2Q:95nIRDdwQhBJOwe8PX27GidBw8Hj
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\prefs.js
Size 6KB
SHA256 42750a4b3c4cd366ef640b547d7eeb15dbe62768b0bf6351a911d162d7409e7b
MD5 a20726b11a876f402a23cdf595d058e9
SHA1 90b373b693f0333b4c5369f59a67393e97ad5232
SHA512 ceb917ddfcd99dae70ca533c7e2225db2d99a4785fb1e94f80330334b6fd0fcd3e27ffd3fc9bcd730ea74895ae70a751b946ef873f6e76e50e778be8b2938381
SSDEEP 96:xHY85nUTeqGq8CdwMGeOTzS6PXAnpjaHDZnpGidBw8V2Q:95nIRDdwMGeEPXB7GidBw8Vj
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 7a0d8862045ab6198441906534a2345d4e2084e11d220b5123072ef47e6303ef
MD5 04d6cc12b835d428e1dd721c2342ebc4
SHA1 934aad783af16b98366c161ba1e3fe632c972797
SHA512 aa8071969eeab9a52e1d7aaf102faf2c2223dc1d33535524fd5d17db9ec689cd5e534a3980a5d4217cf6e1e8e9021431eaaa005ab7afd31920836d130e575bd0
SSDEEP 96:O0WWJRC6ctZHH0lUh9kWwEGJF7VIMZkKzf8W8Qge3ZwS2yvudJby:ODrjyWdiFeMZkauem+vkJby
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\pzuz3epu.default-release\sessionstore-backups\recovery.jsonlz4
Size 4KB
SHA256 d288d4ad0f540f2c3ca7b3054546f34de668557094fe2424e49f7607cd3e42bb
MD5 6127e29977bfb48bcc2612b64afbbccf
SHA1 8b5e0dbcf4c2d091ec4d2c25ae2f5465079f5cf1
SHA512 74169d2200018b200660060733f6d819c68222ca1ee72aa3e6e89e5e5ea1fee2707a2adba497dcbaa0bef8d1237c219304eeb5a6d015dfb434206604910b33fa
SSDEEP 96:O0WWJRC6ctZHH0lUh9vWwEGJF7VIMZkKzf8W8Qge3ZwS2yvu6Jby:ODrj9WdiFeMZkauem+vbJby
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1208-351-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-345-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-348-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-256-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-364-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-249-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-248-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-232-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-366-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-368-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-379-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-381-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-383-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-390-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1208-90-0x0000000000BA0000-0x000000000168F000-memory.dmp

Download

memory/1400-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/1400-33-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-26-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-28-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-87-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-29-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-31-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-35-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-36-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-37-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-51-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-47-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-49-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-48-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-46-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-40-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/1400-45-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/1400-43-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/2164-367-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-27-0x0000000009AE0000-0x0000000009F9A000-memory.dmp

Download

memory/2164-236-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-255-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-69-0x0000000006220000-0x0000000006E22000-memory.dmp

Download

memory/2164-19-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-384-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-101-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-98-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-382-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-380-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-88-0x0000000006220000-0x0000000006D0F000-memory.dmp

Download

memory/2164-91-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-247-0x0000000006220000-0x0000000006D0F000-memory.dmp

Download

memory/2164-70-0x0000000006220000-0x0000000006E22000-memory.dmp

Download

memory/2164-326-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-22-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-21-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-239-0x0000000006220000-0x0000000006E22000-memory.dmp

Download

memory/2164-347-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-44-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-350-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-378-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-356-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-16-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-365-0x00000000012E0000-0x000000000179A000-memory.dmp

Download

memory/2164-18-0x00000000012E1000-0x000000000130F000-memory.dmp

Download

memory/2452-14-0x0000000000B40000-0x0000000000FFA000-memory.dmp

Download

memory/2452-15-0x0000000000B40000-0x0000000000FFA000-memory.dmp

Download

memory/2452-17-0x0000000006560000-0x0000000006A1A000-memory.dmp

Download

memory/2452-4-0x0000000000B40000-0x0000000000FFA000-memory.dmp

Download

memory/2452-3-0x0000000000B40000-0x0000000000FFA000-memory.dmp

Download

memory/2452-2-0x0000000000B41000-0x0000000000B6F000-memory.dmp

Download

memory/2452-0-0x0000000000B40000-0x0000000000FFA000-memory.dmp

Download

memory/2452-1-0x0000000077220000-0x0000000077222000-memory.dmp

Download

memory/2956-92-0x0000000000400000-0x0000000001002000-memory.dmp

Download

memory/2956-71-0x0000000000400000-0x0000000001002000-memory.dmp

Download