strrat | 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Analysis

max time kernel
1799s
max time network
1801s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 13:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14052163e50c197697c64b143.exe
Size 17.6MB
Sample240409-qvlrtabe9s
SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
MD5 14052163e50c197697c64b1431b42271
SHA1 df301332faa73c3d5f915fde61df2fc9de21a61a
SHA512 124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab
SSDEEP 393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strrat discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

strrat

rar.ydns.eu:9999
svchost.ydns.eu:10000

Attributes

license_id
khonsari
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
false
secondary_startup
false
startup
true

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://files.catbox.moe/fvl5hy.jpg

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

Blocklisted process makes network request 59 IoCs

flow	pid	Process
34	4540	wscript.exe
41	4540	wscript.exe
42	4540	wscript.exe
47	4540	wscript.exe
49	3464	powershell.exe
50	3464	powershell.exe
62	4540	wscript.exe
70	4540	wscript.exe
72	4540	wscript.exe
73	4540	wscript.exe
76	4540	wscript.exe
77	4540	wscript.exe
79	4540	wscript.exe
80	4540	wscript.exe
81	4540	wscript.exe
82	4540	wscript.exe
84	4540	wscript.exe
85	4540	wscript.exe
87	4540	wscript.exe
93	4540	wscript.exe
94	4540	wscript.exe
96	4540	wscript.exe
98	4540	wscript.exe
99	4540	wscript.exe
100	4540	wscript.exe
101	4540	wscript.exe
102	4540	wscript.exe
103	4540	wscript.exe
104	4540	wscript.exe
105	4540	wscript.exe
106	4540	wscript.exe
107	4540	wscript.exe
108	4540	wscript.exe
109	4540	wscript.exe
110	4540	wscript.exe
111	4540	wscript.exe
112	4540	wscript.exe
113	4540	wscript.exe
114	4540	wscript.exe
115	4540	wscript.exe
116	4540	wscript.exe
117	4540	wscript.exe
118	4540	wscript.exe
119	4540	wscript.exe
120	4540	wscript.exe
121	4540	wscript.exe
122	4540	wscript.exe
123	4540	wscript.exe
124	4540	wscript.exe
125	4540	wscript.exe
126	4540	wscript.exe
127	4540	wscript.exe
128	4540	wscript.exe
129	4540	wscript.exe
130	4540	wscript.exe
131	4540	wscript.exe
132	4540	wscript.exe
133	4540	wscript.exe
134	4540	wscript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	14052163e50c197697c64b143.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1928	EmbraTor Mac Smash Bullet.exe
5016	x.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	x.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3924	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral3/memory/5016-123-0x0000000000F70000-0x0000000002196000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings	14052163e50c197697c64b143.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	powershell.exe
3464	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3464	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1928	EmbraTor Mac Smash Bullet.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 760	4548	14052163e50c197697c64b143.exe	89
PID 4548 wrote to memory of 760	4548	14052163e50c197697c64b143.exe	89
PID 4548 wrote to memory of 760	4548	14052163e50c197697c64b143.exe	89
PID 4548 wrote to memory of 3656	4548	14052163e50c197697c64b143.exe	90
PID 4548 wrote to memory of 3656	4548	14052163e50c197697c64b143.exe	90
PID 4548 wrote to memory of 3656	4548	14052163e50c197697c64b143.exe	90
PID 4548 wrote to memory of 4552	4548	14052163e50c197697c64b143.exe	91
PID 4548 wrote to memory of 4552	4548	14052163e50c197697c64b143.exe	91
PID 4548 wrote to memory of 4552	4548	14052163e50c197697c64b143.exe	91
PID 4548 wrote to memory of 1044	4548	14052163e50c197697c64b143.exe	92
PID 4548 wrote to memory of 1044	4548	14052163e50c197697c64b143.exe	92
PID 4548 wrote to memory of 1928	4548	14052163e50c197697c64b143.exe	93
PID 4548 wrote to memory of 1928	4548	14052163e50c197697c64b143.exe	93
PID 4548 wrote to memory of 1928	4548	14052163e50c197697c64b143.exe	93
PID 4552 wrote to memory of 3464	4552	WScript.exe	94
PID 4552 wrote to memory of 3464	4552	WScript.exe	94
PID 4552 wrote to memory of 3464	4552	WScript.exe	94
PID 1044 wrote to memory of 3924	1044	javaw.exe	96
PID 1044 wrote to memory of 3924	1044	javaw.exe	96
PID 760 wrote to memory of 4540	760	WScript.exe	98
PID 760 wrote to memory of 4540	760	WScript.exe	98
PID 760 wrote to memory of 4540	760	WScript.exe	98
PID 3656 wrote to memory of 5016	3656	WScript.exe	99
PID 3656 wrote to memory of 5016	3656	WScript.exe	99
PID 3656 wrote to memory of 5016	3656	WScript.exe	99

C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe
"C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:4540
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:5016
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3464
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:3924
- C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
  "C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 13a1852cd63bc00ce9196a9de8ae286cdd7fc5d15e401f3b3804fbdd0de9c953
MD5 3aecd805ab24afde027f558a4044210a
SHA1 49fd7685ab1ebb1fa94d1067e16c625da88db99e
SHA512 52a365a6bcbaebb62fc3e2eef90d5faf10bf01138b917e9a505e45192a414d9c516a753bc2dbe94677fac2a427b0641c5a53ac3f1e3fb2b76b7062bd9fd83287
MD5 SHA1 SHA512

Submit Download

rrrrrrrr.ps1

Path C:\ProgramData\rrrrrrrr.ps1
Size 437B
SHA256 4247e7a94a7fd5e4266622a37d91770dfedb12587aff4c2ece7812c56bd2c1fb
MD5 3ad705568172956efe092dfac809642c
SHA1 d34bfb981dd4478998ec767879ea00cd6406c496
SHA512 ef89e5b7eec05f3d9bbd2ab1fdd011c0917ef6241f6f0afba139860578498971559e2c66041c70b28a91fb09fdbb67eeee1d8a75179c65949028b45ecc813f97
MD5 SHA1 SHA512

Submit Download

Antimalware Service Executable.JS

Path C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS
Size 713KB
SHA256 e3a33757c2e596f7ee50a4a41ff58f2e64dbdb062257fe5749ca19b955b0baaf
MD5 c958a31d5e439d5b0d01900e5a85992a
SHA1 fc40d0ef637fe55fbaf83e8f4891e008ac736df6
SHA512 2aa0c813b7c17b01e1c18a3a12fb4f3c8ba9c9fee79a3ed66421959fd0440571e0cba5e90569970655342ce2730e823feae23ef6c5da09248f3da68fc0f3cf1c
SSDEEP 12288:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBO0Xzaj1B+UquKbLZaQlx+2CRQlD+EhajH:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

EmbraTor Mac Smash Bullet.exe

Path C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
Size 1012KB
SHA256 3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d
MD5 5d57e6b8aff1ec900f553789f6796648
SHA1 f9a953cfe6decb237ed98c30faabec8654d99171
SHA512 d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915
SSDEEP 12288:GgOVcYdHbAQkn+DXp79oN/LrveBU2vvFk/hHVEStxJX:GgOnDXToN/LreBU2vvaNtz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Java Install.jar

Path C:\Users\Admin\AppData\Local\Temp\Java Install.jar
Size 92KB
SHA256 16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284
MD5 c55f9247eb8ea19af96292f0893f86b5
SHA1 bd5e6884b8151114af7e45a92525893f4d2aaabd
SHA512 3efab4ee9e3c9d81efd4e2f164c0a2ae72f688cbd0068cc44a063bf4787ba65b8d2a644ac2f7704fbd059d0ba96665aeff46c2bfba820fb42df06eea7e87ccdb
SSDEEP 1536:QL/61A/qP1+9Qc1+jxjciQnGSzPsRBo0fpL9mjMT8mMhe3gnHGvPvxKpjHr9Uy:QLn/qP1CQpjEGyP0Bxf99mYTX3gmvKLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsMpEng.js

Path C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
Size 24.2MB
SHA256 b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458
MD5 690d57b0d8670391bad0876cae078bab
SHA1 32bea01d606128c606b71e19920099c6cb15030f
SHA512 dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4
SSDEEP 49152:34aSO/UYGzBMZ09d1X5EdS76+B0RX8DQQs8ReDlpgU3HApVeOGMmb5cUNWcGTRPk:H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Driver Foundation.vbs

Path C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs
Size 984B
SHA256 2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c
MD5 df00d1e54f85ae90f2f69b73a34c90f4
SHA1 1d3e521a8efc17334f4f578432d5af0bb1ef1951
SHA512 5636973f61dd7cce413049f246b5ede00c736f4ac333508a2176b65524327080e17ac97260cbe908fc2d0b18235ee6d7f7a74c808a7ceaddb9ee6518452fa618
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_qqdjrihd.pdn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qqdjrihd.pdn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 18.1MB
SHA256 41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8
MD5 efcd72ad2d3430248a68e5f960ed5e2b
SHA1 58cc7d2732f401b99926211c0dab319dfc0bba1a
SHA512 d50dd3628e0ed5b6040545e1a1836ffcdde30c4748b220efb7df29aa139b22b814d2466d6808c8dc3af765b9ce8092582720f69187a6562eefd6fca4cb9670e5
SSDEEP 393216:CyBCMSC2S2ExW7Xn7U4pFbTuPEr1ot7tZNH4wU4UFXu1I9EpS:XBCMcmY7XnhFuPG1otRZNpJgB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-205-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-208-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-275-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-273-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-59-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-68-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-271-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-77-0x000001A3FDA00000-0x000001A3FDA01000-memory.dmp

Download

memory/1044-269-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-94-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-267-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-263-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-256-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-252-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-101-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-108-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-113-0x000001A3FDA00000-0x000001A3FDA01000-memory.dmp

Download

memory/1044-116-0x000001A3FDA00000-0x000001A3FDA01000-memory.dmp

Download

memory/1044-117-0x000001A3FDA00000-0x000001A3FDA01000-memory.dmp

Download

memory/1044-236-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-228-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-227-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-43-0x000001A3FDA00000-0x000001A3FDA01000-memory.dmp

Download

memory/1044-152-0x000001A3FDA00000-0x000001A3FDA01000-memory.dmp

Download

memory/1044-151-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-157-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-224-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-36-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-202-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-198-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/1044-195-0x000001A380000000-0x000001A381000000-memory.dmp

Download

memory/3464-92-0x0000000006B10000-0x0000000006B76000-memory.dmp

Download

memory/3464-97-0x0000000006B80000-0x0000000006ED4000-memory.dmp

Download

memory/3464-166-0x0000000005C10000-0x0000000005C2A000-memory.dmp

Download

memory/3464-48-0x0000000004D80000-0x0000000004D90000-memory.dmp

Download

memory/3464-219-0x0000000073B80000-0x0000000074330000-memory.dmp

Download

memory/3464-164-0x00000000087D0000-0x0000000008E4A000-memory.dmp

Download

memory/3464-128-0x0000000007060000-0x00000000070AC000-memory.dmp

Download

memory/3464-125-0x0000000007040000-0x000000000705E000-memory.dmp

Download

memory/3464-179-0x0000000073B80000-0x0000000074330000-memory.dmp

Download

memory/3464-46-0x0000000073B80000-0x0000000074330000-memory.dmp

Download

memory/3464-53-0x0000000004D80000-0x0000000004D90000-memory.dmp

Download

memory/3464-47-0x0000000004DD0000-0x0000000004E06000-memory.dmp

Download

memory/3464-186-0x0000000004D80000-0x0000000004D90000-memory.dmp

Download

memory/3464-89-0x0000000006930000-0x0000000006996000-memory.dmp

Download

memory/3464-75-0x0000000005BE0000-0x0000000005C02000-memory.dmp

Download

memory/3464-49-0x0000000005440000-0x0000000005A68000-memory.dmp

Download

memory/5016-123-0x0000000000F70000-0x0000000002196000-memory.dmp

Download