strrat | 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Analysis

max time kernel
1188s
max time network
1199s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14052163e50c197697c64b143.exe
Size 17.6MB
Sample240409-qvk6aabe81
SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
MD5 14052163e50c197697c64b1431b42271
SHA1 df301332faa73c3d5f915fde61df2fc9de21a61a
SHA512 124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab
SSDEEP 393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strrat discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

strrat

rar.ydns.eu:9999
svchost.ydns.eu:10000

Attributes

license_id
khonsari
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
false
secondary_startup
false
startup
true

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Blocklisted process makes network request 38 IoCs

flow	pid	Process
34	1576	wscript.exe
42	1576	wscript.exe
46	1576	wscript.exe
48	1576	wscript.exe
52	1576	wscript.exe
56	1576	wscript.exe
75	1576	wscript.exe
77	1576	wscript.exe
78	1576	wscript.exe
79	1576	wscript.exe
80	1576	wscript.exe
81	1576	wscript.exe
83	1576	wscript.exe
84	1576	wscript.exe
85	1576	wscript.exe
86	1576	wscript.exe
87	1576	wscript.exe
88	1576	wscript.exe
89	1576	wscript.exe
90	1576	wscript.exe
91	1576	wscript.exe
92	1576	wscript.exe
93	1576	wscript.exe
94	1576	wscript.exe
95	1576	wscript.exe
96	1576	wscript.exe
97	1576	wscript.exe
98	1576	wscript.exe
99	1576	wscript.exe
100	1576	wscript.exe
101	1576	wscript.exe
102	1576	wscript.exe
103	1576	wscript.exe
104	1576	wscript.exe
105	1576	wscript.exe
106	1576	wscript.exe
107	1576	wscript.exe
108	1576	wscript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	14052163e50c197697c64b143.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
4992	EmbraTor Mac Smash Bullet.exe
3096	x.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Wine	x.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2044	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral3/memory/3096-134-0x00000000008A0000-0x0000000001AC6000-memory.dmp	autoit_exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4772	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	14052163e50c197697c64b143.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	powershell.exe
3920	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3096	x.exe
3096	x.exe
3096	x.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3096	x.exe
3096	x.exe
3096	x.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4992	EmbraTor Mac Smash Bullet.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 3400	1488	14052163e50c197697c64b143.exe	89
PID 1488 wrote to memory of 3400	1488	14052163e50c197697c64b143.exe	89
PID 1488 wrote to memory of 3400	1488	14052163e50c197697c64b143.exe	89
PID 1488 wrote to memory of 2956	1488	14052163e50c197697c64b143.exe	90
PID 1488 wrote to memory of 2956	1488	14052163e50c197697c64b143.exe	90
PID 1488 wrote to memory of 2956	1488	14052163e50c197697c64b143.exe	90
PID 1488 wrote to memory of 2184	1488	14052163e50c197697c64b143.exe	91
PID 1488 wrote to memory of 2184	1488	14052163e50c197697c64b143.exe	91
PID 1488 wrote to memory of 2184	1488	14052163e50c197697c64b143.exe	91
PID 1488 wrote to memory of 3768	1488	14052163e50c197697c64b143.exe	92
PID 1488 wrote to memory of 3768	1488	14052163e50c197697c64b143.exe	92
PID 1488 wrote to memory of 4992	1488	14052163e50c197697c64b143.exe	93
PID 1488 wrote to memory of 4992	1488	14052163e50c197697c64b143.exe	93
PID 1488 wrote to memory of 4992	1488	14052163e50c197697c64b143.exe	93
PID 2184 wrote to memory of 3920	2184	WScript.exe	94
PID 2184 wrote to memory of 3920	2184	WScript.exe	94
PID 2184 wrote to memory of 3920	2184	WScript.exe	94
PID 3768 wrote to memory of 2044	3768	javaw.exe	96
PID 3768 wrote to memory of 2044	3768	javaw.exe	96
PID 3400 wrote to memory of 1576	3400	WScript.exe	98
PID 3400 wrote to memory of 1576	3400	WScript.exe	98
PID 3400 wrote to memory of 1576	3400	WScript.exe	98
PID 2956 wrote to memory of 3096	2956	WScript.exe	101
PID 2956 wrote to memory of 3096	2956	WScript.exe	101
PID 2956 wrote to memory of 3096	2956	WScript.exe	101
PID 3096 wrote to memory of 2204	3096	x.exe	104
PID 3096 wrote to memory of 2204	3096	x.exe	104
PID 3096 wrote to memory of 2204	3096	x.exe	104
PID 2204 wrote to memory of 4772	2204	cmd.exe	107
PID 2204 wrote to memory of 4772	2204	cmd.exe	107
PID 2204 wrote to memory of 4772	2204	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe
"C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:1576
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:4772
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:2044
- C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
  "C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 d160aa7aa671ea669b0ff99581f7011206cf977277e5e904ab566b0756c47b7c
MD5 43a4363c38d9214637b5c54028b405ae
SHA1 6a0e1dc1403839e7cd990eeadf141972c9643399
SHA512 d8a8eb5a244d852f61a6b9736939cebac63480c0824d50ec3e70acd3d5428cc30f03bdfbdfe03ff190c8802b15c4301000836e1813ae3e5941495e5aeb6c7981
MD5 SHA1 SHA512

Submit Download

Antimalware Service Executable.JS

Path C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS
Size 713KB
SHA256 e3a33757c2e596f7ee50a4a41ff58f2e64dbdb062257fe5749ca19b955b0baaf
MD5 c958a31d5e439d5b0d01900e5a85992a
SHA1 fc40d0ef637fe55fbaf83e8f4891e008ac736df6
SHA512 2aa0c813b7c17b01e1c18a3a12fb4f3c8ba9c9fee79a3ed66421959fd0440571e0cba5e90569970655342ce2730e823feae23ef6c5da09248f3da68fc0f3cf1c
SSDEEP 12288:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBO0Xzaj1B+UquKbLZaQlx+2CRQlD+EhajH:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

EmbraTor Mac Smash Bullet.exe

Path C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
Size 1012KB
SHA256 3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d
MD5 5d57e6b8aff1ec900f553789f6796648
SHA1 f9a953cfe6decb237ed98c30faabec8654d99171
SHA512 d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915
SSDEEP 12288:GgOVcYdHbAQkn+DXp79oN/LrveBU2vvFk/hHVEStxJX:GgOnDXToN/LreBU2vvaNtz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Java Install.jar

Path C:\Users\Admin\AppData\Local\Temp\Java Install.jar
Size 92KB
SHA256 16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284
MD5 c55f9247eb8ea19af96292f0893f86b5
SHA1 bd5e6884b8151114af7e45a92525893f4d2aaabd
SHA512 3efab4ee9e3c9d81efd4e2f164c0a2ae72f688cbd0068cc44a063bf4787ba65b8d2a644ac2f7704fbd059d0ba96665aeff46c2bfba820fb42df06eea7e87ccdb
SSDEEP 1536:QL/61A/qP1+9Qc1+jxjciQnGSzPsRBo0fpL9mjMT8mMhe3gnHGvPvxKpjHr9Uy:QLn/qP1CQpjEGyP0Bxf99mYTX3gmvKLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsMpEng.js

Path C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
Size 24.2MB
SHA256 b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458
MD5 690d57b0d8670391bad0876cae078bab
SHA1 32bea01d606128c606b71e19920099c6cb15030f
SHA512 dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4
SSDEEP 49152:34aSO/UYGzBMZ09d1X5EdS76+B0RX8DQQs8ReDlpgU3HApVeOGMmb5cUNWcGTRPk:H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Driver Foundation.vbs

Path C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs
Size 984B
SHA256 2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c
MD5 df00d1e54f85ae90f2f69b73a34c90f4
SHA1 1d3e521a8efc17334f4f578432d5af0bb1ef1951
SHA512 5636973f61dd7cce413049f246b5ede00c736f4ac333508a2176b65524327080e17ac97260cbe908fc2d0b18235ee6d7f7a74c808a7ceaddb9ee6518452fa618
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4r4gd1uh.xxe.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4r4gd1uh.xxe.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 18.1MB
SHA256 41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8
MD5 efcd72ad2d3430248a68e5f960ed5e2b
SHA1 58cc7d2732f401b99926211c0dab319dfc0bba1a
SHA512 d50dd3628e0ed5b6040545e1a1836ffcdde30c4748b220efb7df29aa139b22b814d2466d6808c8dc3af765b9ce8092582720f69187a6562eefd6fca4cb9670e5
SSDEEP 393216:CyBCMSC2S2ExW7Xn7U4pFbTuPEr1ot7tZNH4wU4UFXu1I9EpS:XBCMcmY7XnhFuPG1otRZNpJgB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3096-134-0x00000000008A0000-0x0000000001AC6000-memory.dmp

Download

memory/3768-266-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-253-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-275-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-54-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-271-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-56-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-277-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-292-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-269-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-267-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-221-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-78-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-85-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-43-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-100-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-108-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-259-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-274-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-113-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-120-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-122-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-126-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-132-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-35-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-171-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-176-0x0000022434760000-0x0000022434761000-memory.dmp

Download

memory/3768-181-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-189-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-193-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-196-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-199-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-202-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3768-206-0x0000022435FD0000-0x0000022436FD0000-memory.dmp

Download

memory/3920-50-0x0000000073480000-0x0000000073C30000-memory.dmp

Download

memory/3920-109-0x00000000066E0000-0x000000000672C000-memory.dmp

Download

memory/3920-106-0x0000000006570000-0x000000000658E000-memory.dmp

Download

memory/3920-77-0x00000000061A0000-0x00000000064F4000-memory.dmp

Download

memory/3920-72-0x0000000006090000-0x00000000060F6000-memory.dmp

Download

memory/3920-75-0x0000000006130000-0x0000000006196000-memory.dmp

Download

memory/3920-66-0x0000000005EB0000-0x0000000005ED2000-memory.dmp

Download

memory/3920-48-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/3920-46-0x0000000005110000-0x0000000005120000-memory.dmp

Download

memory/3920-47-0x0000000005750000-0x0000000005D78000-memory.dmp

Download

memory/3920-44-0x0000000004FD0000-0x0000000005006000-memory.dmp

Download