Overview

overview

10

Static

static

10

14052163e5...43.exe

windows7-x64

10

14052163e5...43.exe

windows10-1703-x64

10

14052163e5...43.exe

windows10-2004-x64

10

14052163e5...43.exe

windows11-21h2-x64

10

Antimalwar...ble.js

windows7-x64

8

Antimalwar...ble.js

windows10-1703-x64

8

Antimalwar...ble.js

windows10-2004-x64

8

Antimalwar...ble.js

windows11-21h2-x64

8

EmbraTor M...et.exe

windows7-x64

1

EmbraTor M...et.exe

windows10-1703-x64

1

EmbraTor M...et.exe

windows10-2004-x64

1

EmbraTor M...et.exe

windows11-21h2-x64

1

Java Install.jar

windows7-x64

1

Java Install.jar

windows10-1703-x64

7

Java Install.jar

windows10-2004-x64

7

Java Install.jar

windows11-21h2-x64

7

MsMpEng.js

windows7-x64

10

MsMpEng.js

windows10-1703-x64

9

MsMpEng.js

windows10-2004-x64

9

MsMpEng.js

windows11-21h2-x64

10

Windows Dr...on.vbs

windows7-x64

10

Windows Dr...on.vbs

windows10-1703-x64

10

Windows Dr...on.vbs

windows10-2004-x64

10

Windows Dr...on.vbs

windows11-21h2-x64

10

Resubmissions

09-04-2024 13:34

240409-qvlrtabe9s 10

09-04-2024 13:34

240409-qvk6aabe81 10

09-04-2024 13:33

240409-qthzjabe5z 10

09-04-2024 13:33

240409-qthc1abe5y 10

07-07-2023 11:45

230707-nw632ahf6w 10

Analysis

  • max time kernel
    299s
  • max time network
    297s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 13:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    14052163e50c197697c64b143.exe

  • Size

    17.6MB

  • MD5

    14052163e50c197697c64b1431b42271

  • SHA1

    df301332faa73c3d5f915fde61df2fc9de21a61a

  • SHA256

    4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

  • SHA512

    124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab

  • SSDEEP

    393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg

Score
10/10
strratevasionpersistencestealertrojan

Malware Config

Extracted

Family

strrat

C2

rar.ydns.eu:9999

svchost.ydns.eu:10000
Attributes
  • license_id

    khonsari

  • plugins_url

    http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5

  • scheduled_task

    false

  • secondary_startup

    false

  • startup

    true

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://files.catbox.moe/fvl5hy.jpg

Signatures

  • STRRAT

    STRRAT is a remote access tool than can steal credentials and log keystrokes.

    trojanstealerstrrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Blocklisted process makes network request 12 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe
    "C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"
        3⤵
        • Blocklisted process makes network request
        • Drops startup file
        • Adds Run key to start application
        PID:2356
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Users\Admin\AppData\Local\Temp\x.exe
        "C:\Users\Admin\AppData\Local\Temp\x.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2732
        • C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
          C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2808
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2060
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
            5⤵
            • Creates scheduled task(s)
            PID:2280
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2228
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 0
            5⤵
            • Delays execution with timeout.exe
            PID:1544
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2388
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"
      2⤵
        PID:2160
      • C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
        "C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2576
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {35EB4222-BE3B-4D57-929D-A7C209E25FD4} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2224
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1224
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
            7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
            4⤵
              PID:1656
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1764
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1812
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
            3⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1752
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1936
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:2208
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
            3⤵
            • Executes dropped EXE
            PID:2524
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          2⤵
          • Executes dropped EXE
          PID:2756
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
          2⤵
          • Executes dropped EXE
          PID:1504
      • C:\Windows\system32\wbem\WMIADAP.EXE
        wmiadap.exe /D /T
        1⤵
          PID:1872

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\rrrrrrrr.ps1
          Filesize

          437B

          MD5

          3ad705568172956efe092dfac809642c

          SHA1

          d34bfb981dd4478998ec767879ea00cd6406c496

          SHA256

          4247e7a94a7fd5e4266622a37d91770dfedb12587aff4c2ece7812c56bd2c1fb

          SHA512

          ef89e5b7eec05f3d9bbd2ab1fdd011c0917ef6241f6f0afba139860578498971559e2c66041c70b28a91fb09fdbb67eeee1d8a75179c65949028b45ecc813f97

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\32.exe
          Filesize

          7.4MB

          MD5

          7f9e6ee81558b38fbe276f60949d38b9

          SHA1

          6358b944b0515b04da8fe7fda7dc3dbbfb82423c

          SHA256

          6cd0a0976cff64c5287c166b73e5c877f026274f85599344756c47e9aa756bcb

          SHA512

          960966cc6254f15d5653ec9dbfe0fdc6725f2c1209b4ddb8b1c68d8f646521340f91029a53a5c8c60c9f813f3fe3e83644b052913178ac75886ccbd894be9ce3

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\64.exe
          Filesize

          8.4MB

          MD5

          a2a5a9b937771a4b82694c844fd27e36

          SHA1

          402e2f7bfe1f24d6ea048d58bf156676132f515d

          SHA256

          390126ab71cd12f414f4200cc246d5283c534ab216794ce9980048779960ea68

          SHA512

          d352b147c8f045f9931725d25166916ce081ac5cf251f2987fb011deed2e8d3e08f91dbce8a2464abab5561b7915d69cbb7a0d02437b30b6fd3d5622621149e1

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS
          Filesize

          713KB

          MD5

          c958a31d5e439d5b0d01900e5a85992a

          SHA1

          fc40d0ef637fe55fbaf83e8f4891e008ac736df6

          SHA256

          e3a33757c2e596f7ee50a4a41ff58f2e64dbdb062257fe5749ca19b955b0baaf

          SHA512

          2aa0c813b7c17b01e1c18a3a12fb4f3c8ba9c9fee79a3ed66421959fd0440571e0cba5e90569970655342ce2730e823feae23ef6c5da09248f3da68fc0f3cf1c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
          Filesize

          14.6MB

          MD5

          cfe4b8f7535c958ea26cde6f32b559aa

          SHA1

          253ba3372c6c0b1c301f6e968c4fb7d5ffd696d0

          SHA256

          0afc8b7c47f48ef991535d435d48411ea12c4b98f14253a27b15ec6d7f020620

          SHA512

          01e8862cb7c1a3b247d09ca8e9f94c40232aaed93ab9f1937de0f69f83ba3d32926b6289b7bc5b8ae2bb06876b915a50ed65bb8ba10ffadcbbee579ce968bd39

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Java Install.jar
          Filesize

          92KB

          MD5

          c55f9247eb8ea19af96292f0893f86b5

          SHA1

          bd5e6884b8151114af7e45a92525893f4d2aaabd

          SHA256

          16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284

          SHA512

          3efab4ee9e3c9d81efd4e2f164c0a2ae72f688cbd0068cc44a063bf4787ba65b8d2a644ac2f7704fbd059d0ba96665aeff46c2bfba820fb42df06eea7e87ccdb

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
          Filesize

          24.2MB

          MD5

          690d57b0d8670391bad0876cae078bab

          SHA1

          32bea01d606128c606b71e19920099c6cb15030f

          SHA256

          b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458

          SHA512

          dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
          Filesize

          2KB

          MD5

          9160347bec74471e1a79edfd950629ae

          SHA1

          c149a7e5aab6e349a70b7b458d0eaaa9d301c790

          SHA256

          0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab

          SHA512

          b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs
          Filesize

          984B

          MD5

          df00d1e54f85ae90f2f69b73a34c90f4

          SHA1

          1d3e521a8efc17334f4f578432d5af0bb1ef1951

          SHA256

          2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c

          SHA512

          5636973f61dd7cce413049f246b5ede00c736f4ac333508a2176b65524327080e17ac97260cbe908fc2d0b18235ee6d7f7a74c808a7ceaddb9ee6518452fa618

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\asacpiex.dll
          Filesize

          14.6MB

          MD5

          2380aed7f261148fdb35af6688e408ee

          SHA1

          fa359778d16c934ba96b96f3c6c17a10a9e266b0

          SHA256

          12afa4813940c6985259f487d5e2892550596a60c6c77f806aefa2c254c74bb4

          SHA512

          646bdbc4f01991460755c6a2c2dbbca0a0170c83d06050ba50ec1b5406d58f8035498c84462dd9e6ab1d695b8854e2f4734d64ec2f4ab1083371fd145963bb85

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
          Filesize

          5.4MB

          MD5

          297d5f7d7b56f1a649dac04369b63d1c

          SHA1

          0684a35b1f162bfb648b6686285026d433a0ced4

          SHA256

          9e5e1fddf69616fd0140f2725719256e96df0bd423903ac7f06ceba494110e2e

          SHA512

          704906fb1fbb78bd0c1ad760f11361a94440d61cad5fd244d5a2be18f01f980911295dc572d7275f269e25539dfca464e14ed41130c22edc42833c32ecf9a49d

          Download Submit

        • \Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
          Filesize

          722KB

          MD5

          43141e85e7c36e31b52b22ab94d5e574

          SHA1

          cfd7079a9b268d84b856dc668edbb9ab9ef35312

          SHA256

          ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d

          SHA512

          9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc

          Download Submit

        • \Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
          Filesize

          1012KB

          MD5

          5d57e6b8aff1ec900f553789f6796648

          SHA1

          f9a953cfe6decb237ed98c30faabec8654d99171

          SHA256

          3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d

          SHA512

          d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915

          Download Submit

        • \Users\Admin\AppData\Local\Temp\x.exe
          Filesize

          18.1MB

          MD5

          efcd72ad2d3430248a68e5f960ed5e2b

          SHA1

          58cc7d2732f401b99926211c0dab319dfc0bba1a

          SHA256

          41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8

          SHA512

          d50dd3628e0ed5b6040545e1a1836ffcdde30c4748b220efb7df29aa139b22b814d2466d6808c8dc3af765b9ce8092582720f69187a6562eefd6fca4cb9670e5

          Download Submit

        • memory/2160-166-0x0000000002590000-0x0000000005590000-memory.dmp

          Filesize

          48.0MB

          Download

        • memory/2160-153-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2160-74-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2160-52-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2160-83-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2160-84-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2160-48-0x0000000002590000-0x0000000005590000-memory.dmp

          Filesize

          48.0MB

          Download

        • memory/2160-95-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2160-49-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2160-161-0x0000000000140000-0x0000000000141000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2388-51-0x0000000002930000-0x0000000002970000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2388-122-0x0000000072F90000-0x000000007353B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2388-38-0x0000000002930000-0x0000000002970000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2388-41-0x0000000002930000-0x0000000002970000-memory.dmp

          Filesize

          256KB

          Download

        • memory/2388-37-0x0000000072F90000-0x000000007353B000-memory.dmp

          Filesize

          5.7MB

          Download

        • memory/2480-60-0x000000001CD70000-0x000000001DF96000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-143-0x0000000001970000-0x0000000001971000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2732-147-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-71-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-63-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-139-0x00000000018D0000-0x00000000018D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2732-154-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-160-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-116-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-121-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download

        • memory/2732-129-0x0000000000050000-0x0000000001276000-memory.dmp

          Filesize

          18.1MB

          Download