ffd63fe2aeaa91f05bef47b3583290ccdba3f44912ab8b67044f3d58bf817ebf

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
29-06-2024 10:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stormshot.PC.V1.0_01debe9140.exe
Size

2.8MB
MD5

6aae47cbaa4c56095a1eb0422c1d2ecb
SHA1

34e29d1801d270a2bd7ac02d4ea84c14c553d66f
SHA256

ffd63fe2aeaa91f05bef47b3583290ccdba3f44912ab8b67044f3d58bf817ebf
SHA512

d6b2406922d2618816db55110bf12a8579b69325e0c196d0d2508bafec68a0430acf48482160bf42cca4bd0995d864abfa2425e8e5af794c8d8d1c430fee4cff
SSDEEP

49152:c8ZQVqWu+fqu79LNTRBO1L2VQjJY80KruthaPVu+2zE0y5VCmdAlacRk3Y:vZARtBEqVQq80ThzTzEElask3Y

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\st_global = "F:\\FunPlus\\Stormshot\\Launcher.exe"	PC-Launcher.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	st_01debe9140.exe
File opened (read-only)	\??\D:	PC-Launcher.exe
File opened (read-only)	\??\F:	PC-Launcher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 3 IoCs

pid	Process
2196	st_01debe9140.exe
3020	Launcher.exe
2536	PC-Launcher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Stormshot.PC.V1.0_01debe9140.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Stormshot.PC.V1.0_01debe9140.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PC-Launcher.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PC-Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	PC-Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PC-Launcher.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell\open\command	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell\open	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\shell\open\command\ = "F:\\FunPlus\\Stormshot\\Launcher.exe %1"	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\DefaultIcon\ = "F:\\FunPlus\\Stormshot\\Launcher.exe"	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\ = "URL:funplus.st Protocol"	Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\URL Protocol	Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\funplus.st\DefaultIcon	Launcher.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 0f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 19000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca61d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e4090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f006700690065007300000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a92000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd	PC-Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d4624030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PC-Launcher.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a040000000100000010000000324a4bbbc863699bbe749ac6dd1d46242000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	PC-Launcher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6	PC-Launcher.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2536	PC-Launcher.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2020	Stormshot.PC.V1.0_01debe9140.exe
2004	chrome.exe
2004	chrome.exe
2196	st_01debe9140.exe
2196	st_01debe9140.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	PC-Launcher.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe
Token: SeShutdownPrivilege	2004	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2004	chrome.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe
2536	PC-Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2428	2004	chrome.exe	29
PID 2004 wrote to memory of 2428	2004	chrome.exe	29
PID 2004 wrote to memory of 2428	2004	chrome.exe	29
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1388	2004	chrome.exe	31
PID 2004 wrote to memory of 1300	2004	chrome.exe	32
PID 2004 wrote to memory of 1300	2004	chrome.exe	32
PID 2004 wrote to memory of 1300	2004	chrome.exe	32
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33
PID 2004 wrote to memory of 2504	2004	chrome.exe	33

C:\Users\Admin\AppData\Local\Temp\Stormshot.PC.V1.0_01debe9140.exe
"C:\Users\Admin\AppData\Local\Temp\Stormshot.PC.V1.0_01debe9140.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2020
- C:\Users\Admin\AppData\Local\Temp\st_01debe9140.exe
  C:\Users\Admin\AppData\Local\Temp\st_01debe9140.exe
  2⤵
  - Enumerates connected drives
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2196
- - F:\FunPlus\Stormshot\Launcher.exe
    "F:\FunPlus\Stormshot\Launcher.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3020
  - - F:\FunPlus\Stormshot\1.0.0.76\PC-Launcher.exe
      "F:\FunPlus\Stormshot\1.0.0.76\PC-Launcher.exe" --currentPath="F:\FunPlus\Stormshot" --configVersion=1.0.0.76 --launchExe="F:\FunPlus\Stormshot\Launcher.exe"
      4⤵
      Adds Run key to start application
      Enumerates connected drives
      Executes dropped EXE
      Checks processor information in registry
      Modifies system certificate store
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6f39758,0x7fef6f39768,0x7fef6f39778
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1556 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2328 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1016 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:2
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1260 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3420 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1224,i,2080546934177530876,15661602007997195764,131072 /prefetch:8
  2⤵
  PID:816

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3735ff41f5d52e042c2d2a5a2256efd

SHA1
88119e3c52047c4051ec177c0b5bc65d4a49c9c6

SHA256
63239cf589e51b2f87acab9dca67822e64860e05decfd914df61ca3f4751a02f

SHA512
5d06354c47cf9f2d30c72c77b35b1136810b308aa7f3e72c69a5047aabb22f7539e0e015f31384cbf35cd8a94c3a8eadb012e1d2d5e47cc15e1a0e429a17918c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ba4edc52-a493-43fe-a7e6-75b78db8d6f6.tmp

Filesize
301KB

MD5
91a66e5c63c8248820705dab03ff8168

SHA1
196eacec44212e83041ea25d063287e5d2c36f83

SHA256
bc38d4c74c0c4578d504ff24f6f569859973839b08fa593bfb4c44be7790b0ae

SHA512
96477d8df2f5334aaf1b5cb5f05408a430f8106a052f3bd942a11bad091ae0194ccba69fe0b8e3b8c66ab914436ed77f43087e9073d1ad39fc4f2bd013e508ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DCB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DEE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\st_01debe9140.exe

Filesize
38.2MB

MD5
b0cfda6d19ba0890a2a5e28fc64e495b

SHA1
42bf31008666486853048d917bf29a77e190a905

SHA256
c481aaa4196c31b98511a33bfcd0a7c3754e8e8164de17f66ca66b1c34360b84

SHA512
089bc8201e831024bbcd69ae393727bb2e6cb47c7595a0cfa07a3c01b7c1119b65574885865b344bdd1f453100c0fde89dd908d75925b91fc903b407a5e56f22

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\FPXGameManager32.dll

Filesize
303KB

MD5
1ab57f03324dac918ebd937427aec89a

SHA1
73e5f05ee04543411031c6c2413c2beba556fac0

SHA256
f71050d20b7b07d5801751ed901f11913f9ed8542992e4e0e79100adfe2cfcca

SHA512
8b4545c81b55f23b165f38724fa1949a6adce8dd335ae803ebf7fb2d2975d5855e8758f0b4cf91949afed4356f1054240bbf8b9c9f9dd05db8df1a91ad53bbff

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\MSVCP140.dll

Filesize
425KB

MD5
d4e9ae2301232a7599807ae02023187e

SHA1
af68af4f51c1affd0a8c29b3e707642636374583

SHA256
322af358aad037db8136623586e65fedbba3040b355f76ed34e7aa1763b2dc89

SHA512
5fe2cba77f0c285c519142a71cc1e6216b4ad78077aebf1c3f23e84e4b8fcd7f9cb6363668674869e3bd2c56ffd178b2c2d51725ab38e0a2338e5dc15d7d05f8

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\MSVCP140_1.dll

Filesize
20KB

MD5
ca7c343e1f6ffdacd0818b9e46ad58a5

SHA1
9731858d1cc5f1c1ca3bb2253df8feb9a912b8f2

SHA256
87428634883461f50ef4dc812273dc8822cf608b32ef6f11bcc61223052c1ae1

SHA512
13602dbd97f41dfb32f9c2cb5fcc263fd2663667374372b4414f64f0f56191419a79e74add3286524710d1b75869933cd21c8d8401ff6df6d711dd8efc8800d9

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\PC-Launcher.exe

Filesize
8.9MB

MD5
e2b0d24bbc85a2a0842cab0670dbdee6

SHA1
3f3c0a889f20de785e8fc43f034304929a3a3df3

SHA256
7a2000e6ec139e7726929b1816c8bf159b6988e683e256caff4ba234cbcfc75b

SHA512
3e948dee29620777a25f030d2716e3946d91e535d0181d783fce5bc0a9eca94994f8c3230e386dcc0180cd1100596f3b342679e6ad9eeda03a627bc3473987cd

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5Core.dll

Filesize
5.2MB

MD5
ccb1f269d09dae974fe338ac807966f0

SHA1
5bbc886073b68ac54c28e5cd2f81392b532e5c55

SHA256
1cd06fffc17269a864fec6ec8f47bbf8af3f5d1cfa391f173ae63da4c7a7b498

SHA512
2e82eebae0b9c4c7f7168aa89082d51e45c8622ad831c13b1a2219ba22db50dcff9e4846642dbfe8103f18bc8277d35753494be7aaa3791929975d135345f4b8

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5Gui.dll

Filesize
5.7MB

MD5
00375b48f58242be0aeb9fea5db47a34

SHA1
f5ff390642cf75f562aa43e5041b3ecaeae19e8e

SHA256
b5d8b8997a484f342739e15689b4a29389c1cd99e61d8a2ab208bc5644c1d8a8

SHA512
3aa570d2395019bea0be84523a1c81f9a8bc8ae984066f478aa7ff967fbc241f150bc23b0d9bd727a960b0799d84e1d36d46a7bd8e5ff95b60b24a4cc92130b0

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5Network.dll

Filesize
1.0MB

MD5
6ac9a28a6fbc7f48e7504f34b5480797

SHA1
348d596e4566cc99cb7b78ba4e9076ba9d8a1d38

SHA256
fc6179c80db2afb79f67b2f0e39ed1739717129ae30b8b81c6155f17ba83c576

SHA512
a3a5da0bce62d5ec48563b93e4faf59e89162afa8f5c01ae23198490b9b202251baa550582d84d83e51187b93ca77b7bb7a3c3ec07950b283f49e16beb6f077a

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5Qml.dll

Filesize
2.9MB

MD5
2247c7ba00ffd5fb0b8bed697e7e7ab3

SHA1
0977e47d8efb192fd2a05c845e5633109858ea0d

SHA256
61bc4ed1824d6c1327d298a7a788d7ce3d8a2e64dd9e7955fd08088920890642

SHA512
2331e1d1dfb71f1482efd1d5ba4c71e67ca84570e089a020d4cfc9341dc3053bd79a39448ad952b53f9055ca49cbbbd6b0f1d071f96ca5b16a3e3d7fa585949c

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5QmlModels.dll

Filesize
349KB

MD5
b79193c4770635dbc6d578d4bc24142a

SHA1
83aea1916910f865449a2db90a68e9c1cfd22a1f

SHA256
e488c6ae94e9610f8df22a97732c918f3261c32a897c3c357e6fc8995e94810b

SHA512
37f362fe14dfebacf32cea643a59a059f6e6116c6986516c98681b0314290894c9cfc7571d7ce04dbeab93aad5a869eb7ff586a88f7b30606e1ce05a6cd94a46

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5QmlWorkerScript.dll

Filesize
52KB

MD5
0a481a9b25f05852dbadc934633a72c1

SHA1
4f736ee9475b2654bea7209586176573027105d7

SHA256
f5d6d8c34e5129103918b1fa7234ea61870eb7a3d9dc70804a3b1e2359a2c9b4

SHA512
f0731db999329f96385680bebc6d2211e82b3a8655f80523f80d0aae1e6f3e334382fedbf3b6900c5dc89408389890bbdc13d497d1130dfbb911d3e2e0ed97bc

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5Quick.dll

Filesize
3.4MB

MD5
474a9e2de31376e21bce06d9cacef668

SHA1
c3ee8d3008d1daa6cce23d1261ea3f7bf4ab5308

SHA256
82156019afb320612a4b48243b05c7c8477770c83b23af836c7c99563fa26786

SHA512
5c894e47ff3853f1d692e3ab8f773ed70161cb05e497b8cc9412a060366dd7ddb4bc01939671d5ad6853d83c4a7641625d0b4f6eacf40d34401e3f12269773df

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5QuickWidgets.dll

Filesize
72KB

MD5
a2075c10b993bccd74523823d362a727

SHA1
e2f324e0f29bfa2b4016649aacecb71074e7a835

SHA256
2f3f0142e9b82e5c6d4f84c04578255a957981ee14ac96d76f5b93f0ca1c6769

SHA512
2dfd91deb83fa0ba2115ec8c03cd20515063fcf69a6919e5fa023672251d519664d33e8662670625745f85784445a559133c03a10bc7986859221045bbd07216

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5Svg.dll

Filesize
264KB

MD5
37265e6e2e85b59f9cc85c9b8fba9074

SHA1
f1db159aeb042fc9aa2d017e67a0a384ee9e5382

SHA256
f4453045b5bb77f14ab3ff2e7a05d6aa49681f3120851ccfb8e33660cd2662da

SHA512
ef9de075a05defcd6812bff34f4d7cbbeb9d7c39d17c213ab120b93410b43415be8bbfab78a4c911ffd2e4361df9efcc9e4b21fd725e8e67e49a87f6764a7579

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5WebSockets.dll

Filesize
125KB

MD5
aaeac5122ab6a42e8b186ea771a72cc7

SHA1
26194f8d020d332990f33883294eb51bb8472bea

SHA256
41da80ee11c6d9caffa0ec863e61faf665c0ab3fea5add6febf131d2ad45071e

SHA512
f38b8c176f03c47bb7ed7942edfbcff7be20b1e796c5fa62a4fec2e3c7b664de06989699cd50be9c1cbae3501a9ac854870030576f5a4a8cc1cabf19bd73cf21

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\Qt5Widgets.dll

Filesize
4.3MB

MD5
a372a06ef5d5dfaeca77e54597585e03

SHA1
035c5bc89dd0fbe93ce411ebcb808c5fb50cc63d

SHA256
14230cbb6fcabd799c0269723c0f77dc46d4b89789b3d8eba0920ea217548c5a

SHA512
e68a5df0a1a70f0a11127d071dc528dec43a0d7e34ae568b282f3ed888a674b8ae0c80c0714d7f04fdc4a2fe4e820ae4629bf3429be7ab606784d9107b9f8604

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\QtQuick.2\qmldir

Filesize
131B

MD5
d2cf96786ce59e93a2feb2178603a27f

SHA1
7478dfedcd7ac1795bf4ff2732ef716ec82b061a

SHA256
b6f63056ade6925aa070d3b2bd4133d26e80df4ea2719e81ad90027e19661ae8

SHA512
4fcde288c6a690728f919b70308b3bb2ead62c40223bea14e52ec5f3ef74f5467b1930f419df77d78b8d50e84ec81a1fe78cc9a3b42c4a6d261ba77c654a1714

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\QtQuick.2\qtquick2plugin.dll

Filesize
26KB

MD5
c37e3d04acb53488b1558f3c7f686036

SHA1
5b6a38908a84e3bfa4bb60703ec3b351bcbc5327

SHA256
9aed7aac5e2530221ece8d3a66315e1818b7516d935f43a5554484b4d4d4daa1

SHA512
277f21ea145dc2281eee24f601136a2904ff607b01a9d9262ae6d5eefd0d9d3b6c0a9a3a209c7dbc9d7d7ace0a9d5357803b0370e3353f386c2f0654d868f8c7

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\QtQuick\Timeline\qmldir

Filesize
134B

MD5
8610059f5530f0e4b2111a2e1596db94

SHA1
a2908e9b5b5254d4a190e8ab8f63ab968b6ef670

SHA256
50e526690f8c397d9136436a1b44f1d93ae0363f5dabab98481b8788e42add13

SHA512
cc7c92afeed6a286193b02ae4646aa601462649b3edb634499c4f23bc4cf2dbc33133bb099e563e4198991f9f73f5cbfd8b8c712d94de08eebcab9d7fa2bef90

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\QtQuick\Timeline\qtquicktimelineplugin.dll

Filesize
56KB

MD5
d9d0b9b8a3fe6ba53d8a1ff3759d56e7

SHA1
b1094cf2d378e76799c8d4de530680eef27b20a1

SHA256
63adf5c163f04e8186f0a38676c8fc46649d02acd6a87e5fda6b76b0b47d0cfc

SHA512
9aec692806c215104a5c08fcb4efff0b74c82f81fe1b6fb73c3e12659cc8f03b8831d3d8bebf9fa0bc488c9ca4950014c4f33f3f89baa060bb7f6388356c4634

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\VCRUNTIME140.dll

Filesize
76KB

MD5
2cec885177f8e329a314f975806d0e3d

SHA1
942d6525d23833ac51af1fd0cb6c18f0aacc90fa

SHA256
e4989178cb90a65428bcb19b2f1d2c811ab66077b38c0645522d8669b176b99e

SHA512
210d12d8912341e1625bbc603060aaf37ded1fec58fe677b0f92dd5bdc89d1629f29b50f7e95985bda6c7f316790f753dee2305d154ae94f5ee7816886e91fb1

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\fpxcore.dll

Filesize
6.6MB

MD5
8082299bc394324885eaadaa880c37f6

SHA1
4512b2441622d56089b12273feeb5ab466391639

SHA256
87434863f2a2f89b672adab0d2ba791fc01ba474b7a6ebbf20b85ae761f6a1c1

SHA512
91389a1b1fd2dd2743d88fb666e1a9d855ab3b73c75215be044daeb001a7dc744a82f3ced013e8def4d8449cd0612ebddd26cc04b555e1d3343773bdc747a10b

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\iconengines\qsvgicon.dll

Filesize
40KB

MD5
34732c85bc4f9bb4a4a2297a0aa20aad

SHA1
7e8d22f248e8d23b208807df1c86db99435afe49

SHA256
79e48711e6bdd497e9efc7c423f34f30d742db0aa04c0febd3b214004526a818

SHA512
3cb974eca119d2f521219c9f8037cd484d116a41ab3c8f2886b2219b75ff16c7accf619ba985645d1a8dc2c32c7acb10b03e3169111e786bd90a18fd69267f17

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qgif.dll

Filesize
38KB

MD5
6f1b578054aadf5e184d9153a0537364

SHA1
136c349a97957f406e45a60247fc1d2bd4296294

SHA256
c0964a239ba5b0b5262ac6ed36d41ba4b8c466d5e8cfc8577f8a061197e6272d

SHA512
28cc8d72e524dfbebc6ae35c150f874c082652cc6bc1d99712d0211219e893d63dfefeed8981dd2ed1097cf217d852c50845355d39691045bf19d53fa171750c

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qicns.dll

Filesize
42KB

MD5
3e887a30afb41edefc0651eed9478942

SHA1
5c132f72c3fb02497d565bfe066d1813e4d1e668

SHA256
af8a95934fddaee350425a26206b732567d6f47e52b33853447382e553df1916

SHA512
e9319e42349b491c9afb0ca72a1696f8af15e2b4bc9db0667057fecfd8b4fc7166c7ac4a0d764cd036c0784b5731b881a3da58d0914469b6e5495168172f8a48

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qico.dll

Filesize
36KB

MD5
3f7d35e556b2223286a9c70869192b20

SHA1
5e520e616170b4efd7f37f1f083b8c1613eedf8e

SHA256
004e88375bdf797c20a1fb83bcc461882155c3ce0bc51ef9f99f89beea11858b

SHA512
2158f0851cb08160e57aaba56e7eb7c6cf9d4e2e8104e2a458b23e8f11b468f1ce8950f45b1c85a777aade8c1ab3b53ba80eda4b101bd0689356d736294d8b18

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qjpeg.dll

Filesize
385KB

MD5
7adbe963467564d0e33335f9208209ab

SHA1
9773b6f12728e3e7b388972b5e44bcdbc5eb6d0b

SHA256
dfe1df3c8e7dec4a2e754f48012ccc18baa59b1332fa908a4cc34d09f260d010

SHA512
38f7e3bb4af8ac34abb779f2fbb64c9f96e9070de6385b2cfb381261ea863705d19ae9cb4a975f14f4b0fa62e9a47e1c3a21dccacd89989edc991f7b04b78d8d

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qpdf.dll

Filesize
33KB

MD5
6ec14154abfab839695ba85ba1d0d675

SHA1
7a6b116c5cb09fc6b2d48c0923395baddd7bbbc5

SHA256
7e05e808865b8633ff507482beefee9da290dbe5741bf12f0dae9eaf6faa0fdf

SHA512
e4bcc00221d9b3b9f1efb73e2e95c8c3fc906dc386cda4a3b486936cf62d2679ac291a0e754456d46d972ced7d906685f7778a3227f513f8cd8d0cc2308aba26

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qsvg.dll

Filesize
32KB

MD5
891c2966d58483c0e4b98dceb37d642a

SHA1
b1dbb83e021994b3ab8f3a3f5f9a7b5c7dfd9a1d

SHA256
236085c82fbbe4cc9a4a96a5744916da729cdfee91e89a8b56b68b0e8b831960

SHA512
1948f2bc9fe207ad2d5c2f23366ade8c27271bf6ca090e67c433c9033bde92852b5524d91d71f07a7277b18c1ecec966b0c5d6c6400dfff94c73969e2a7d0200

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qtga.dll

Filesize
31KB

MD5
015dba45aedc50a3ee5737c6bc7c97b1

SHA1
44545cd8ed24081a68f4524848c716f6c00e8281

SHA256
0adfc1901455be8fa9cfe420b0529c9f7a1fadcee4140ec0441256a1bb2235da

SHA512
66ad7811aba986339a2bd806aca7f5f8b33d2d4140e0cea5619642a3761447a2e8ef260cf06e22daf37df5df573b77b830cec9281065b64778a0bae3b5ac8376

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qtiff.dll

Filesize
356KB

MD5
6742a1c8b9687561ff37f385ac492c30

SHA1
5b9d8f698dc1ec47ab791225707db4af59360efc

SHA256
de742e6d940061f32d2dcaedbeaab6006f55b181db16d08faa66fc6eaf1ba8c2

SHA512
4eb40d887b6250951cb14f68918d3e6133367b246692b4d4eaf4c970d823d1183998280c1113e8453270dee8e94c52bb2ff36a6aed692b5bded3cefa480d64a6

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qwbmp.dll

Filesize
30KB

MD5
9228078a9ab4aa393a99c32b1a399e35

SHA1
6184f51bcfd52e3e14cdc0b595189fc7f89acdb9

SHA256
e45ac8841b5cb23ce1c46c8ca23cee7002ee66c77e6a6c8fde6e3a6a9ced581e

SHA512
f78aafbcc43af9ba9928619d55c1cc6ce3d996122cf9a68a31e9583317cbee31a88d62105eaf21053546b2ab5517761adf3f85e21ab444475b385fc9c52d6817

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\imageformats\qwebp.dll

Filesize
409KB

MD5
1bd1829d0fdd041dec9d50c8c0a77e32

SHA1
728afbad0fcf76395f98a46e1da06c500cdf8472

SHA256
190da7505ed54ad3ad06a274e73f00f26405a043bcac86fc437549dde8070719

SHA512
4dc545b03b9399c57ca01a69cff45d332fbb9da996746d8bf7fd84ec3cefcc45772a35c30a4cdd0f589ecf83910440dcbebd2b05fd7f6361f08004ebbb504eb5

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\libEGL.DLL

Filesize
27KB

MD5
b376aef29ac7182c5295c7c832b2572a

SHA1
2b5cf8ecb72ab961434d7404f37d75ea708673f7

SHA256
8bba8a3a48eda82e55ee804b4410a6223be10ef24e37264d1ad3af8b066c1261

SHA512
e1d93ed5850f1e71a8666078e20dcf6db4502643e43b2aab69c16d42af02b5872efbfb9e80362670e6f951a5fd39f519f94d241ebb740ecfcf5847b66f27b44f

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\libGLESv2.dll

Filesize
2.8MB

MD5
face71fafc50dd1faf2f0c18af2c2d29

SHA1
297679eee244a5aa941deb9481256fd8c89a18d4

SHA256
33570abecf27463aa26bfffb1a9e6d3a2c4f43f878b4279a0782314b3db4a1af

SHA512
23fc3317170cb5430237b1801d42d85d2ef788da3c634e974cc0ac668f5f26eb28cedd9ebfe8aa0cc52b53436c3c205140c30a6b463d9d9eba6bfe19457fd109

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\libcrypto-1_1.dll

Filesize
2.4MB

MD5
0399619c3a5fe9ed498af787cdc10f15

SHA1
23d7b48d4a99d18b3d6987b9ffd9ad5ff8f3498a

SHA256
fb5071bdfbfb59fb1102ed7c159edfb291e90d08c864ea4e372415192da19fc2

SHA512
0dd63c0f54a7228b8641f7c0d33f8b7051315ea9da53f48ffc3c9ff78a43cb31406585962f0d31eef1f85013c50279c30efde41672e18794e723c37226eca44d

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\libssl-1_1.dll

Filesize
520KB

MD5
9ad86cd2cf928eec82bb877a50bed442

SHA1
319ee98c31f3a142abea30ab933c78062d860765

SHA256
7041e2c62651c6f1215dd0fa325ec3bb0e9dda5dc956a54e20b0089e4e1c7eec

SHA512
5ccd0de6782291da7ce0460d804156123eff25a78c67c6af3daadf745b8136f31a864410c509cdf9a22fe8d80ba75888ce74320c43c200227081d2fb48a52f36

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\platforms\qwindows.dll

Filesize
1.2MB

MD5
981f9dc4f537012d21aab34071896788

SHA1
58e0c4baf55f1908c6abf8f2b81fa5cab6a5c840

SHA256
334f317e5afd0b9cf05e85ba1c241e57cc84833658c6db04595c0f1accdfe69c

SHA512
d4327a401909fe8b0e9cf561c525a51fbd6e168cf6daf1513653c524b08d0fe12b9b2db588a3398ef1285e993cd3078a9d3770a676a001c61f3f358178266e5d

Download Submit
F:\FunPlus\Stormshot\1.0.0.76\styles\qwindowsvistastyle.dll

Filesize
132KB

MD5
b65e3ef6042684b489d0cb2574b4d144

SHA1
98747aec7f187d03ee2604fca947744efcab0b99

SHA256
9fd317f3da3eee0d53dc78687aad61440dfbc30a0d42169be434731e11f423bb

SHA512
980a7e9a9265c275beeba3469a0e676bb68f0b18ee760b43c0b9ab9856a11cf23175d10b53532299e1f8c1f5b74aaace61352eef398b4307267812a698f0e008

Download Submit
F:\FunPlus\Stormshot\InstallSettings.ini

Filesize
88B

MD5
89e84425cdc7f562516a8b2abf0a9941

SHA1
2bc293941fd2facd26fa0a72fc8c887e1f56a7d4

SHA256
3c55c24208467af3d1d4296a2baccae9890300ee4e0b35c7634d8987d046b40f

SHA512
d076976fc0980b0bd7e0b4ff6e80e180df004b50ce56bfe241110740cb73f6e5dfbc5f42da9337f62a1aaefc44de70192be1a6d121434abc7883ff2564afe4cc

Download Submit
F:\FunPlus\Stormshot\Launcher.exe

Filesize
1.1MB

MD5
52471ba3a9e13d7caf35aa92a03f36c5

SHA1
6bcc450ad85c0c086c6c3a0db4b72997039ad305

SHA256
8c90c8880dfca8a967413a60e0c68af376f56eb59bd92812bbfaffabcbf4cfe6

SHA512
57fcf47b319ae08918bd6adefae7d41dd11de3ca45684000db48baf25d029b88f91df96f5a417a8c8e4d5b7778bfac642f44d8bae6c47a9d68a5e2a1bab57afc

Download Submit
F:\FunPlus\Stormshot\config\version.ini

Filesize
16B

MD5
33d55ee6e7cbb05dfbe8a172ad8041e0

SHA1
c785c14c29d5e5fc8f83ed0f5c7ec94ff2f39f75

SHA256
188fa22428bb326c12f81a05919e2c6f6f5807193e86ed43fc182b9a14115e7f

SHA512
0332835af6089c9018c64745f68c9e6d77e299577e444170228b5989140286db271461da428098183657254ae515edd672f6109f9e0e72d538f55b8fb154f78b

Download Submit
F:\FunPlus\Stormshot\prefs\st_global_setting.ini

Filesize
84B

MD5
7ba803c7520b1754183da866a1362abd

SHA1
31d97063263515e83ac4058f05ee9ec762524e3f

SHA256
3bd25aa4501e6bded34910789b03aeb0f90d775ebcdf1d23ac5d53e3dcf96a0b

SHA512
8f95262d5eba32228ff77a52fc6e105968a4c9c4d85592343d203415031e623f8ccebc8d0eff55885ab68872668138826aec06a85ac9d3d50f55fa39559249bd

Download Submit
F:\FunPlus\Stormshot\prefs\st_global_setting.ini.lock

Filesize
64B

MD5
6b3d148db0440fc51b1b98a22ea82d86

SHA1
9056697a6178728ec42ce14357b6f560baa1deee

SHA256
c70749538708ff33e9b4a7875139dac94524a774affc289672bafb411becd9ad

SHA512
2cd3d821a33a929d83c37e693546e0f07e40e7c75ec5ec1c6fbf3ff6506a4b835d83ff608166c2ccf6b4bf3cb368e7bb5a81da770f21a88ce6b495b10278ca56

Download Submit
F:\FunPlus\Stormshot\uninstall.exe

Filesize
1.6MB

MD5
b7e9693e094902dcabdc5e9fcb0623b1

SHA1
dc2fcba3bd0a4d5fc0b44723ab595acb45700b29

SHA256
fc0d611a1c8f8a5075f9fdc85991caf47ddf0e840195e8a8afd732a476bfda1c

SHA512
83c6913e34105a31ac08f4ca2d8ae721c82362c606f782a8ea7fe89edc28b16e5d6c5605e8d1ee722e073e0b3bd3f991dc1058dcf6b65add8dee885c409d1e4d

Download Submit
memory/2196-149-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/2536-957-0x0000000072AA0000-0x0000000072B0A000-memory.dmp

Filesize
424KB

Download
memory/2536-940-0x00000000748A0000-0x00000000749A7000-memory.dmp

Filesize
1.0MB

Download
memory/2536-818-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/2536-807-0x0000000006620000-0x0000000006A60000-memory.dmp

Filesize
4.2MB

Download
memory/2536-937-0x0000000074CA0000-0x0000000075000000-memory.dmp

Filesize
3.4MB

Download
memory/2536-954-0x0000000072B80000-0x0000000072B89000-memory.dmp

Filesize
36KB

Download
memory/2536-955-0x0000000072B20000-0x0000000072B7B000-memory.dmp

Filesize
364KB

Download
memory/2536-945-0x0000000073720000-0x0000000073CD0000-memory.dmp

Filesize
5.7MB

Download
memory/2536-963-0x0000000071B80000-0x0000000071B88000-memory.dmp

Filesize
32KB

Download
memory/2536-962-0x0000000071DC0000-0x0000000071DCF000-memory.dmp

Filesize
60KB

Download
memory/2536-961-0x0000000071DE0000-0x0000000071DE9000-memory.dmp

Filesize
36KB

Download
memory/2536-960-0x0000000072090000-0x0000000072302000-memory.dmp

Filesize
2.4MB

Download
memory/2536-959-0x0000000072310000-0x0000000072397000-memory.dmp

Filesize
540KB

Download
memory/2536-941-0x0000000074360000-0x0000000074897000-memory.dmp

Filesize
5.2MB

Download
memory/2536-936-0x0000000075000000-0x0000000075012000-memory.dmp

Filesize
72KB

Download
memory/2536-809-0x0000000006A60000-0x0000000006C60000-memory.dmp

Filesize
2.0MB

Download
memory/2536-958-0x0000000072400000-0x0000000072AA0000-memory.dmp

Filesize
6.6MB

Download
memory/2536-953-0x0000000072B90000-0x0000000072BD2000-memory.dmp

Filesize
264KB

Download
memory/2536-951-0x0000000072BF0000-0x0000000072C52000-memory.dmp

Filesize
392KB

Download
memory/2536-952-0x0000000072BE0000-0x0000000072BEA000-memory.dmp

Filesize
40KB

Download
memory/2536-950-0x0000000072C60000-0x0000000072C6B000-memory.dmp

Filesize
44KB

Download
memory/2536-949-0x0000000072C70000-0x0000000072C7C000-memory.dmp

Filesize
48KB

Download
memory/2536-948-0x0000000072C80000-0x0000000072C8B000-memory.dmp

Filesize
44KB

Download
memory/2536-947-0x0000000072D80000-0x0000000072DA3000-memory.dmp

Filesize
140KB

Download
memory/2536-946-0x0000000072DC0000-0x0000000072EF2000-memory.dmp

Filesize
1.2MB

Download
memory/2536-939-0x00000000749B0000-0x0000000074C92000-memory.dmp

Filesize
2.9MB

Download
memory/2536-944-0x0000000074030000-0x0000000074037000-memory.dmp

Filesize
28KB

Download
memory/2536-943-0x0000000074230000-0x0000000074245000-memory.dmp

Filesize
84KB

Download
memory/2536-942-0x0000000074250000-0x00000000742BD000-memory.dmp

Filesize
436KB

Download
memory/2536-956-0x0000000072B10000-0x0000000072B19000-memory.dmp

Filesize
36KB

Download
memory/2536-938-0x0000000075040000-0x0000000075099000-memory.dmp

Filesize
356KB

Download
memory/2536-817-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download