Malware Analysis Report

2025-03-15 00:02

Sample ID 240924-h3cvwayflg
Target 20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch
SHA256 7b47aa3bdda6bba0b01e90f6975bb2144463156d7d52ec612532fdc1a81eb283
Tags
hackbrowserdata discovery infostealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7b47aa3bdda6bba0b01e90f6975bb2144463156d7d52ec612532fdc1a81eb283

Threat Level: Known bad

The file 20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch was found to be: Known bad.

Malicious Activity Summary

hackbrowserdata discovery infostealer

HackBrowserData

An open source browser data exporter written in golang.

Executes dropped EXE

Looks up external IP address via web service

Suspicious use of SetThreadContext

Browser Information Discovery

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-24 07:15

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-24 07:15

Reported

2024-09-24 07:17

Platform

win7-20240903-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe

"C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-24 07:15

Reported

2024-09-24 07:17

Platform

win10v2004-20240802-en

Max time kernel

95s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe"

Signatures

An open source browser data exporter written in golang.

Description Indicator Process Target
N/A N/A N/A N/A

HackBrowserData

infostealer hackbrowserdata

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\script_cookie_encrypted.exe N/A
N/A N/A C:\Users\Admin\rate.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3736 set thread context of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 1872 set thread context of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Browser Information Discovery

discovery

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\script_cookie_encrypted.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3328 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe C:\Users\Admin\script_cookie_encrypted.exe
PID 3328 wrote to memory of 3736 N/A C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe C:\Users\Admin\script_cookie_encrypted.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3736 wrote to memory of 3344 N/A C:\Users\Admin\script_cookie_encrypted.exe C:\Program Files\Internet Explorer\iexplore.exe
PID 3328 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe C:\Users\Admin\rate.exe
PID 3328 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe C:\Users\Admin\rate.exe
PID 1872 wrote to memory of 2276 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 1872 wrote to memory of 2276 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 1872 wrote to memory of 2276 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
PID 1872 wrote to memory of 1656 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1872 wrote to memory of 1656 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1872 wrote to memory of 1656 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
PID 1872 wrote to memory of 1356 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 1872 wrote to memory of 1356 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 1872 wrote to memory of 1356 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 2984 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 4860 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 4860 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
PID 1872 wrote to memory of 4860 N/A C:\Users\Admin\rate.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe

"C:\Users\Admin\AppData\Local\Temp\20240923f4a3f6f96ce30d5a0890afb2816978cecobaltstrikepoetratsnatch.exe"

C:\Users\Admin\script_cookie_encrypted.exe

C:\Users\Admin\script_cookie_encrypted.exe

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe"

C:\Users\Admin\rate.exe

C:\Users\Admin\rate.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 205.12.26.104.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 52.252.190.167:56001 tcp
US 8.8.8.8:53 167.190.252.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\script_cookie_encrypted.exe

MD5 b50c04edf22d51016e00d6f385b41cc7
SHA1 22295a90e102a3ffdada9f52230fb9e604bac281
SHA256 2a7cae1fd866ff4f11e5c41c428b9b3c1078df3b523706d8a5145c55bd359ba9
SHA512 a574405593129fd729d8bf5fdcf6813cb68870cbb1124969def626db06069ccb2e18841c73ca5f34f71d33b4edd9c1982b6282a6f3e66b645e1043eff45f1f73

memory/3344-5-0x0000000000400000-0x0000000000DED000-memory.dmp

C:\Users\Admin\rate.exe

MD5 0c8bc5317e4b23f1e6dd3a2b7af70255
SHA1 49dd70a5dfb41a77806f0abb0b9f54d0cd01d652
SHA256 af847306fa5457d15f4d378e2622f6ff3f92c9a093810f760bf1f3cc91aacb7f
SHA512 e95a567a70df88ac1226fd4973a6103f195c38f1790750047feead51b186434d88ab5a525c77cbe509f6fa8d8c90b77fac9daf2a48d31f85db12ab1b11863878

memory/1872-9-0x00007FF82AAE3000-0x00007FF82AAE5000-memory.dmp

memory/1872-10-0x000001B95B0B0000-0x000001B95B0B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/1872-56-0x00007FF82AAE0000-0x00007FF82B5A1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

memory/1872-148-0x000001B9756A0000-0x000001B975750000-memory.dmp

memory/2984-149-0x0000000000400000-0x000000000045C000-memory.dmp

memory/1872-150-0x00007FF82AAE0000-0x00007FF82B5A1000-memory.dmp

memory/2984-151-0x0000000005380000-0x000000000543A000-memory.dmp

memory/2984-152-0x0000000005520000-0x0000000005586000-memory.dmp