Malware Analysis Report

2024-12-07 20:47

Sample ID 230817-c17pksgf6y
Target 155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar
SHA256 155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550
Tags
strrat persistence stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550

Threat Level: Known bad

The file 155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar was found to be: Known bad.

Malicious Activity Summary

strrat persistence stealer trojan

STRRAT

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-08-17 02:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-08-17 02:33

Reported

2023-08-17 02:36

Platform

win7-20230712-en

Max time kernel

150s

Max time network

153s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

Signatures

STRRAT

trojan stealer strrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar C:\Windows\system32\java.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550 = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar\"" C:\Windows\system32\java.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550 = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar\"" C:\Windows\system32\java.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2236 wrote to memory of 2956 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 2236 wrote to memory of 2956 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 2236 wrote to memory of 2956 N/A C:\Windows\system32\java.exe C:\Windows\system32\cmd.exe
PID 2236 wrote to memory of 2972 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\java.exe
PID 2236 wrote to memory of 2972 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\java.exe
PID 2236 wrote to memory of 2972 N/A C:\Windows\system32\java.exe C:\Program Files\Java\jre7\bin\java.exe
PID 2956 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2956 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2956 wrote to memory of 2836 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\schtasks.exe
PID 2972 wrote to memory of 2832 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 2832 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 2832 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2832 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2832 wrote to memory of 2452 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2972 wrote to memory of 1508 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 1508 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 1508 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 1508 wrote to memory of 1820 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1508 wrote to memory of 1820 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1508 wrote to memory of 1820 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2972 wrote to memory of 2180 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 2180 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 2180 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2180 wrote to memory of 2192 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2180 wrote to memory of 2192 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2180 wrote to memory of 2192 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2972 wrote to memory of 2488 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 2488 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2972 wrote to memory of 2488 N/A C:\Program Files\Java\jre7\bin\java.exe C:\Windows\system32\cmd.exe
PID 2488 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2488 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2488 wrote to memory of 2752 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Windows\system32\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

C:\Windows\system32\cmd.exe

cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar"

C:\Program Files\Java\jre7\bin\java.exe

"C:\Program Files\Java\jre7\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar"

C:\Windows\system32\schtasks.exe

schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar"

C:\Windows\system32\cmd.exe

cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"

C:\Windows\System32\Wbem\WMIC.exe

wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list

C:\Windows\system32\cmd.exe

cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"

C:\Windows\System32\Wbem\WMIC.exe

wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list

C:\Windows\system32\cmd.exe

cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"

C:\Windows\System32\Wbem\WMIC.exe

wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list

C:\Windows\system32\cmd.exe

cmd.exe /c "wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list"

C:\Windows\System32\Wbem\WMIC.exe

wmic /node:localhost /namespace:'\\root\securitycenter' path antivirusproduct get displayname /format:list

Network

Country Destination Domain Proto
US 8.8.8.8:53 efcc.duckdns.org udp
NL 103.212.81.155:1243 efcc.duckdns.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp

Files

memory/2236-61-0x0000000002140000-0x0000000005140000-memory.dmp

memory/2236-63-0x0000000000220000-0x0000000000221000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

MD5 81672f4c4a4b89a9753e55e26d393678
SHA1 134e34b47bd0e38424472903f358be7a913051a6
SHA256 155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550
SHA512 6d3976df4a86e038d528c932562142817cba8ff8f00958032440673b13bc110af4e9837700a2b0ccf59f3de84aa0fe0de82e8195f1213b71fa93d9cd18f97010

C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

MD5 81672f4c4a4b89a9753e55e26d393678
SHA1 134e34b47bd0e38424472903f358be7a913051a6
SHA256 155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550
SHA512 6d3976df4a86e038d528c932562142817cba8ff8f00958032440673b13bc110af4e9837700a2b0ccf59f3de84aa0fe0de82e8195f1213b71fa93d9cd18f97010

memory/2972-75-0x0000000002210000-0x0000000005210000-memory.dmp

memory/2972-82-0x0000000000120000-0x0000000000121000-memory.dmp

memory/2972-85-0x0000000002210000-0x0000000005210000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-08-17 02:33

Reported

2023-08-17 02:36

Platform

win10v2004-20230703-en

Max time kernel

39s

Max time network

92s

Command Line

java -jar C:\Users\Admin\AppData\Local\Temp\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

Signatures

STRRAT

trojan stealer strrat

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar C:\ProgramData\Oracle\Java\javapath\java.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar\"" C:\ProgramData\Oracle\Java\javapath\java.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550 = "\"C:\\Program Files\\Java\\jre1.8.0_66\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar\"" C:\ProgramData\Oracle\Java\javapath\java.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A

Processes

C:\ProgramData\Oracle\Java\javapath\java.exe

java -jar C:\Users\Admin\AppData\Local\Temp\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

C:\Windows\SYSTEM32\cmd.exe

cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar"

C:\Program Files\Java\jre1.8.0_66\bin\java.exe

"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar "C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar"

C:\Windows\system32\schtasks.exe

schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar"

Network

Country Destination Domain Proto
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 108.211.229.192.in-addr.arpa udp

Files

memory/3160-137-0x0000000003150000-0x0000000004150000-memory.dmp

memory/3160-148-0x0000000003150000-0x0000000004150000-memory.dmp

memory/3160-149-0x00000000014F0000-0x00000000014F1000-memory.dmp

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

MD5 81672f4c4a4b89a9753e55e26d393678
SHA1 134e34b47bd0e38424472903f358be7a913051a6
SHA256 155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550
SHA512 6d3976df4a86e038d528c932562142817cba8ff8f00958032440673b13bc110af4e9837700a2b0ccf59f3de84aa0fe0de82e8195f1213b71fa93d9cd18f97010

memory/3160-158-0x00000000033D0000-0x00000000033E0000-memory.dmp

memory/3160-159-0x00000000033F0000-0x0000000003400000-memory.dmp

memory/3160-160-0x0000000003400000-0x0000000003410000-memory.dmp

memory/3160-161-0x0000000003150000-0x0000000004150000-memory.dmp

C:\Users\Admin\AppData\Roaming\155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550.jar

MD5 81672f4c4a4b89a9753e55e26d393678
SHA1 134e34b47bd0e38424472903f358be7a913051a6
SHA256 155945b133a7d5fe816d79c352268273f7150c695ada43ee9c5d7565f8a1e550
SHA512 6d3976df4a86e038d528c932562142817cba8ff8f00958032440673b13bc110af4e9837700a2b0ccf59f3de84aa0fe0de82e8195f1213b71fa93d9cd18f97010

C:\Users\Admin\.oracle_jre_usage\90737d32e3aba4b.timestamp

MD5 306edf80e2d8a99d9ac4fba06192aeb9
SHA1 deb4a32ca3d083a7c7a6f2fff90373a7de6cd2fa
SHA256 5a26975b85ede08ac554d06905a0f2fe3c7d9d228a8ff1db375966ea61aea0ae
SHA512 784153894d3d95a86f5fb0e6b38746a3268cdc31079b823e5e379bb027f8ea3cf10dfc60ceaf69779ff13b2ae2a4c77cf32690a4caf6e93e0df7e68ff8f74587

memory/3956-173-0x0000000002450000-0x0000000003450000-memory.dmp

memory/3956-175-0x0000000001F90000-0x0000000001F91000-memory.dmp