quasar | ec78b7b9f3560e19d0c723d7d114747d3833cb940631f9a3dbe83634e8d68491

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8339045F879C83C60A535E72190C6B53.exe
Size 2.9MB
Sample240301-wza4rsbd78
SHA256 ec78b7b9f3560e19d0c723d7d114747d3833cb940631f9a3dbe83634e8d68491
MD5 8339045f879c83c60a535e72190c6b53
SHA1 9a2014f7c7f43c41b4c3985162ef37d21609c9d8
SHA512 c58553a40fa63e6e635db473b1c77e91e74879011929ba5466a318c1709ec023ebc3ad51e670e93bfcbd6aa99f6b63d77b72f30e13b204e26ad4c10e504bd4ef
SSDEEP 49152:MhUcoTm8u5JdsNSv9qoIBChdBI2F/jgflh0cC8rUQzzga4pNqnd0YmTEG70+3xM:eUrhuzKAv9ZIBCbBI2FUEcCIUUzgBpkj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar 27.02 - r spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

27.02 - r

194.87.252.184:4782

Mutex

1127ef31-5071-4c30-bbbe-8bcb36d37abd

Attributes

encryption_key
DD459BB92A43EF8EEB2FE401C8453F685AECE590
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3864-35-0x0000000000800000-0x0000000000B60000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3172 created 3232	3172	Lie.pif	56

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	8339045F879C83C60A535E72190C6B53.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 2 IoCs

pid	Process
3172	Lie.pif
3864	RegAsm.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
4172	tasklist.exe
1516	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings	RegAsm.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1060	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4932	WINWORD.EXE
4932	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3172	Lie.pif

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	tasklist.exe
Token: SeDebugPrivilege	1516	tasklist.exe
Token: SeDebugPrivilege	3864	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3172	Lie.pif
3172	Lie.pif
3172	Lie.pif

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4932	WINWORD.EXE
4932	WINWORD.EXE
3864	RegAsm.exe
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE
4932	WINWORD.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3616	4452	8339045F879C83C60A535E72190C6B53.exe	92
PID 4452 wrote to memory of 3616	4452	8339045F879C83C60A535E72190C6B53.exe	92
PID 4452 wrote to memory of 3616	4452	8339045F879C83C60A535E72190C6B53.exe	92
PID 3616 wrote to memory of 4172	3616	cmd.exe	94
PID 3616 wrote to memory of 4172	3616	cmd.exe	94
PID 3616 wrote to memory of 4172	3616	cmd.exe	94
PID 3616 wrote to memory of 4596	3616	cmd.exe	95
PID 3616 wrote to memory of 4596	3616	cmd.exe	95
PID 3616 wrote to memory of 4596	3616	cmd.exe	95
PID 3616 wrote to memory of 1516	3616	cmd.exe	97
PID 3616 wrote to memory of 1516	3616	cmd.exe	97
PID 3616 wrote to memory of 1516	3616	cmd.exe	97
PID 3616 wrote to memory of 2416	3616	cmd.exe	98
PID 3616 wrote to memory of 2416	3616	cmd.exe	98
PID 3616 wrote to memory of 2416	3616	cmd.exe	98
PID 3616 wrote to memory of 1804	3616	cmd.exe	99
PID 3616 wrote to memory of 1804	3616	cmd.exe	99
PID 3616 wrote to memory of 1804	3616	cmd.exe	99
PID 3616 wrote to memory of 4784	3616	cmd.exe	100
PID 3616 wrote to memory of 4784	3616	cmd.exe	100
PID 3616 wrote to memory of 4784	3616	cmd.exe	100
PID 3616 wrote to memory of 400	3616	cmd.exe	101
PID 3616 wrote to memory of 400	3616	cmd.exe	101
PID 3616 wrote to memory of 400	3616	cmd.exe	101
PID 3616 wrote to memory of 3172	3616	cmd.exe	102
PID 3616 wrote to memory of 3172	3616	cmd.exe	102
PID 3616 wrote to memory of 3172	3616	cmd.exe	102
PID 3616 wrote to memory of 1060	3616	cmd.exe	103
PID 3616 wrote to memory of 1060	3616	cmd.exe	103
PID 3616 wrote to memory of 1060	3616	cmd.exe	103
PID 3172 wrote to memory of 3864	3172	Lie.pif	107
PID 3172 wrote to memory of 3864	3172	Lie.pif	107
PID 3172 wrote to memory of 3864	3172	Lie.pif	107
PID 3172 wrote to memory of 3864	3172	Lie.pif	107
PID 3172 wrote to memory of 3864	3172	Lie.pif	107
PID 3864 wrote to memory of 4932	3864	RegAsm.exe	108
PID 3864 wrote to memory of 4932	3864	RegAsm.exe	108

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3232
- C:\Users\Admin\AppData\Local\Temp\8339045F879C83C60A535E72190C6B53.exe
  "C:\Users\Admin\AppData\Local\Temp\8339045F879C83C60A535E72190C6B53.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Aboriginal Aboriginal.bat & Aboriginal.bat & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      PID:4596
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      PID:2416
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 13287
      4⤵
      PID:1804
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Britney + Styles + Pipeline + Username + Suffer + Excellence 13287\Lie.pif
      4⤵
      PID:4784
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Property 13287\F
      4⤵
      PID:400
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13287\Lie.pif
      13287\Lie.pif 13287\F
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3172
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1060
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13287\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13287\RegAsm.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Резюме (Татьяна Михайлова).doc" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lie.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13287\Lie.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\13287\RegAsm.exe
Size 63KB
SHA256 c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
MD5 0d5df43af2916f47d00c1573797c1a13
SHA1 230ab5559e806574d26b4c20847c368ed55483b0
SHA512 f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
SSDEEP 768:X8XcJiMjm2ieHlPyCsSuJbn8dBhFwlSMF6Iq8KSYDKbQ22qWqO8w1R:rYMaNylPYSAb8dBnsHsPDKbQBqTY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aboriginal

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Aboriginal
Size 10KB
SHA256 c93e967a55d9818f48f146dd5fa1790d50b6b6994806b9a984b296c44caf7e63
MD5 0a788dd6351dedab6170753765a9a7c7
SHA1 7dc9d746c768b752331efee82d9254ca41c02f61
SHA512 8bf11a6f31ee587d9945110a85bace54d3b11c7e7583f8cebb7616db379049a3f05d4ad397abc52010b1cb11ae89a7a2ff912aebec9b8cc744630e4c4d491af3
SSDEEP 192:wkMiLQbffUrqWWMSUxsFNAIykrfTVBSEKfTdVgy0YbMMs1:txwkHBVyFNAI7rbVBSEK7dVgnYbMMs1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Britney

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Britney
Size 146KB
SHA256 67a96529b61982b1b860af5710a7d3f65f33a630f6ce613a64b6eedda79403f2
MD5 15c5fbc1a3a09219a40fe1f07e5789a0
SHA1 16751825db43f1aeb6d50127d42c24457cf3a11e
SHA512 60d74639dd3a08e70e96f175c02321fe8bc23df41191cb81a1fa3c44dde9d053ead08c9e38256dd639153d2e70fa568494edeb0f1e9dec7cea0ea46cf9b5c389
SSDEEP 3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5iRo:LQBk7JjX74cN0lrztgo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Excellence

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Excellence
Size 136KB
SHA256 e0abbd2bbcec3db32823ba43f357df7e9be16defff29a5e1e55b8682624590b5
MD5 c5237eedf621d4e975e22e502bddfa7e
SHA1 509c417d04595c920c5b9655d62e91d9954a5fd1
SHA512 cb7c3c004996e345287048e5c94f90c92f127fb079e23384134547cecc1b93e6882a3cb612deb9e6d4380ceb1f2efeb9b76fa91af93e85597400e3eb04c63e9b
SSDEEP 3072:qKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:fEgarxUaBZ2myoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pipeline

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Pipeline
Size 130KB
SHA256 d0a3c6c90ec7fcae7f332fef3aa6f2bdcea557bab33c9f71acc3146241c621c1
MD5 19c45b5d0324904ad54f457082bfc289
SHA1 187113bc9d7b3e4876552e777361665c8ec48f5c
SHA512 f617d9636703d76e39d1d785406ee8de47170c5761742896c61b1e4ccd26d6eafeaa42ab1af3a3bee8966f3d9d1f95be494979b5fbcaa86da54a54218f208035
SSDEEP 3072:R/9EAehuqCkrwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz5Yak:DEAehuqN8zwNzlmhPL1b5nZ2tk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Property

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Property
Size 4.4MB
SHA256 28ec73e5d81ec24ecb5fb4a25b6010c6394ba45290cb32c1b7e28a51c6703b65
MD5 c80982a59916a5616f9a40f4acf6a2a5
SHA1 20fc58a53f63a592552ee88263809c2970afe0f1
SHA512 cd0f9d3116509002f4b6adfb2004e051ddf30922fb8d407c6ed351d58ab56427e64d4933581b5094c4f9506df02ecd9ff81f0a1be2edd8510826b6c14a6237d6
SSDEEP 24576:6/KZihpJ0j7ng/xcPCON2C3lNdT5OLnNubK/vbdprazb25MQE3qjxDaT3um2ZqMw:6sbWTuGdkwU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Styles

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Styles
Size 110KB
SHA256 c19318190538dceea957e8238407302e971e21a2aea73f7d03d79e90fe8426c2
MD5 21e5764777c71b407678329eaa4a29f5
SHA1 258043dcbd24166ca5c27f6f5e87256ff4cee240
SHA512 698d09c956e95be7776d31b41cdd7246b8fd859afdeff554bcdeb50bb1dff56ecc79258236f276b7b4f961bc90049b92ce53ae9701b21c68ed5f5ad56494c59c
SSDEEP 3072:x3U0Pe3vHU4S4/33SrF7etHufKE5Kmqd1UhlqRW6:VU0Wyw3mFygyE4mqd12lqh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Suffer

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Suffer
Size 183KB
SHA256 32f37d9cf14d6c4974bb84cc5d74119feaf57569da0b0034b08795d5ae1568ee
MD5 6b9a567f7c32aa9133b5c294ccca24a5
SHA1 ae508614bf8944b9dd3d9c8bdc7ae1ac1367d31c
SHA512 a7efe0049b4cdcccf19563a1bb8d51ee17721811e4d4789140835af070d3a699eb267085d239fb170b3cb642955d566221a043194288f851edfeddce27d1aeac
SSDEEP 3072:IA9vtqmcCVs5A3q5eAg0Fuz08XvBNbIaAtbPf6u:HFqZvEAOz04pmdV36u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Username

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Username
Size 219KB
SHA256 13cb3210d145d061929d7c80ade232ff88e8fae54357f83a63651feef4971a5c
MD5 b87bf0e36ad755b2d021931105722dc3
SHA1 cfb5f0ce8725ae3e68415db322a60f934a5fff00
SHA512 44a2faaabc0a6c309e23a42e5d37eb33972426c05b6b4653291345f5332b5bf8d5b8e79dfc22ad7cd5bfc3d9d335634237696e899ff717eaa5a58604dde99489
SSDEEP 6144:i6lfA6Gfm608DsvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYU:i6XKmNvqJWNAB+X0lHPOGNnF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Резюме (Татьяна Михайлова).doc

Path C:\Users\Admin\AppData\Local\Temp\Резюме (Татьяна Михайлова).doc
Size 68KB
SHA256 fba2acea9f965b35c8e1168604df6cfd83dc709ac2878eaa37728e0d2c896f78
MD5 03d642672e29b1c4ae4385d3a279a007
SHA1 8b1c29fb4b0010ea50e7599fc7cbe2be0b123049
SHA512 cd746b644347f15c9f78e93fb40bf34a9e7c92465c72d86aca7555403a303b7482b23ff2677dbc49af73af2c511837c4342fbc23b30b3d3dafef6e316beb1610
SSDEEP 1536:MSxKsaQQwMVkS+qJEUGH53OtFDck2DI3:j4sapDhGH53
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3172-33-0x0000000006880000-0x0000000006881000-memory.dmp

Download

memory/3172-30-0x0000000077051000-0x0000000077171000-memory.dmp

Download

memory/3864-39-0x0000000005680000-0x0000000005C24000-memory.dmp

Download

memory/3864-92-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/3864-40-0x00000000051E0000-0x0000000005272000-memory.dmp

Download

memory/3864-41-0x00000000051D0000-0x00000000051E0000-memory.dmp

Download

memory/3864-42-0x0000000005290000-0x000000000529A000-memory.dmp

Download

memory/3864-35-0x0000000000800000-0x0000000000B60000-memory.dmp

Download

memory/3864-51-0x0000000006BE0000-0x00000000071F8000-memory.dmp

Download

memory/3864-38-0x0000000072B30000-0x00000000732E0000-memory.dmp

Download

memory/3864-91-0x0000000072B30000-0x00000000732E0000-memory.dmp

Download

memory/3864-64-0x00000000068C0000-0x0000000006972000-memory.dmp

Download

memory/3864-72-0x0000000007830000-0x0000000007896000-memory.dmp

Download

memory/3864-56-0x0000000006650000-0x00000000066A0000-memory.dmp

Download

memory/3864-71-0x0000000007780000-0x00000000077BC000-memory.dmp

Download

memory/3864-70-0x0000000006BC0000-0x0000000006BD2000-memory.dmp

Download

memory/4932-55-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-58-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-54-0x00007FFD33D50000-0x00007FFD33D60000-memory.dmp

Download

memory/4932-63-0x00007FFD33D50000-0x00007FFD33D60000-memory.dmp

Download

memory/4932-65-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-61-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-66-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-67-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-62-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-68-0x00007FFD31760000-0x00007FFD31770000-memory.dmp

Download

memory/4932-59-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-69-0x00007FFD31760000-0x00007FFD31770000-memory.dmp

Download

memory/4932-60-0x00007FFD33D50000-0x00007FFD33D60000-memory.dmp

Download

memory/4932-57-0x00007FFD33D50000-0x00007FFD33D60000-memory.dmp

Download

memory/4932-53-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-52-0x00007FFD33D50000-0x00007FFD33D60000-memory.dmp

Download

memory/4932-93-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-94-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-95-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download

memory/4932-96-0x00007FFD73CD0000-0x00007FFD73EC5000-memory.dmp

Download