quasar | c4b75cdc84b5570235c4568fd085b2f82e3fa7ce16e39d56fddc821416129efb

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 23:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 540KB
Sample240327-3v8ykade83
SHA256 c4b75cdc84b5570235c4568fd085b2f82e3fa7ce16e39d56fddc821416129efb
MD5 eaa0ca9decc6b10f87a9ff57bbdd1941
SHA1 7e86c621d0401f4d3168c448d638c1f4e85ae5b2
SHA512 061217a50f40f372e25b707801a07f931900ab74cf951dd490249ceeb27b737717e37039c188db54a9aa4fae5f3b0a8236e13377c61552b5d45869995c8170d6
SSDEEP 6144:TsTjI4aO2DTy3Oxqk/5LDARfoz1Vib62ithQKaVymuabY+F4IFGqStKEbxI2:2I4aO2v5Pofoz1VltD9mi+F3YyEbxZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar microsoftedge spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5.0

Botnet

MicrosoftEdge

common-congratulations.gl.at.ply.gg:65362
127.0.0.1:65362

Mutex

QSR_MUTEX_MKoa3FQkTUYpcQOoO7

Attributes

encryption_key
4ScLZeaXkOHrLSyZOCm8
install_name
MicrosoftEdge.exe
log_directory
Logs
reconnect_delay
3000
startup_key
MicrosoftEdge
subdirectory
MicrosoftEdge

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 3 IoCs

resource	yara_rule
behavioral2/memory/5056-1-0x0000000000850000-0x00000000008DE000-memory.dmp	family_quasar
behavioral2/files/0x0007000000023244-58.dat	family_quasar
behavioral2/memory/2696-75-0x0000000000990000-0x0000000000A1E000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5056 created 632	5056	Client-built.exe	5
PID 2696 created 632	2696	MicrosoftEdge.exe	5

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2696	MicrosoftEdge.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com
26	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ip-api.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5056 set thread context of 3652	5056	Client-built.exe	90
PID 2696 set thread context of 3904	2696	MicrosoftEdge.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2892	3904	WerFault.exe	99
2420	2696	WerFault.exe	96

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4848	SCHTASKS.exe
4152	schtasks.exe
4184	SCHTASKS.exe
4344	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1540	taskmgr.exe
1540	taskmgr.exe
5056	Client-built.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
1540	taskmgr.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
1540	taskmgr.exe
1540	taskmgr.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
1540	taskmgr.exe
1540	taskmgr.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
1540	taskmgr.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
3652	dllhost.exe
2696	MicrosoftEdge.exe
3652	dllhost.exe
3652	dllhost.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	taskmgr.exe
Token: SeSystemProfilePrivilege	1540	taskmgr.exe
Token: SeCreateGlobalPrivilege	1540	taskmgr.exe
Token: SeDebugPrivilege	5056	Client-built.exe
Token: SeDebugPrivilege	5056	Client-built.exe
Token: SeDebugPrivilege	3652	dllhost.exe
Token: SeDebugPrivilege	2696	MicrosoftEdge.exe
Token: SeDebugPrivilege	2696	MicrosoftEdge.exe
Token: SeDebugPrivilege	3904	dllhost.exe
Token: 33	1540	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1540	taskmgr.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe
1540	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2696	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4848	5056	Client-built.exe	87
PID 5056 wrote to memory of 4848	5056	Client-built.exe	87
PID 5056 wrote to memory of 4848	5056	Client-built.exe	87
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 5056 wrote to memory of 3652	5056	Client-built.exe	90
PID 3652 wrote to memory of 5056	3652	dllhost.exe	85
PID 5056 wrote to memory of 4152	5056	Client-built.exe	94
PID 5056 wrote to memory of 4152	5056	Client-built.exe	94
PID 5056 wrote to memory of 4152	5056	Client-built.exe	94
PID 3652 wrote to memory of 4152	3652	dllhost.exe	94
PID 3652 wrote to memory of 4152	3652	dllhost.exe	94
PID 5056 wrote to memory of 2696	5056	Client-built.exe	96
PID 5056 wrote to memory of 2696	5056	Client-built.exe	96
PID 5056 wrote to memory of 2696	5056	Client-built.exe	96
PID 3652 wrote to memory of 2696	3652	dllhost.exe	96
PID 3652 wrote to memory of 2696	3652	dllhost.exe	96
PID 2696 wrote to memory of 4184	2696	MicrosoftEdge.exe	97
PID 2696 wrote to memory of 4184	2696	MicrosoftEdge.exe	97
PID 2696 wrote to memory of 4184	2696	MicrosoftEdge.exe	97
PID 3652 wrote to memory of 4184	3652	dllhost.exe	97
PID 3652 wrote to memory of 4184	3652	dllhost.exe	97
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 2696 wrote to memory of 3904	2696	MicrosoftEdge.exe	99
PID 3652 wrote to memory of 3904	3652	dllhost.exe	99
PID 2696 wrote to memory of 4344	2696	MicrosoftEdge.exe	103
PID 2696 wrote to memory of 4344	2696	MicrosoftEdge.exe	103
PID 2696 wrote to memory of 4344	2696	MicrosoftEdge.exe	103
PID 2696 wrote to memory of 3676	2696	MicrosoftEdge.exe	120
PID 2696 wrote to memory of 3676	2696	MicrosoftEdge.exe	120
PID 2696 wrote to memory of 3676	2696	MicrosoftEdge.exe	120

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{af7721ae-47aa-4447-aa9d-7c57f37cba84}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3652
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{a36f4311-c7a4-4bf3-91b6-384cf5605826}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3904 -s 188
    3⤵
    - Program crash
    PID:2892

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:4848
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks" /create /tn "MicrosoftEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client-built.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4152
- C:\Users\Admin\AppData\Roaming\MicrosoftEdge\MicrosoftEdge.exe
  "C:\Users\Admin\AppData\Roaming\MicrosoftEdge\MicrosoftEdge.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\SysWOW64\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77MicrosoftEdge.exe" /tr "'C:\Users\Admin\AppData\Roaming\MicrosoftEdge\MicrosoftEdge.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4184
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "MicrosoftEdge" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\MicrosoftEdge\MicrosoftEdge.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:4344
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /delete /tn "MicrosoftEdge" /f
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 2672
    3⤵
    - Program crash
    PID:2420

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3904 -ip 3904
1⤵
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2696 -ip 2696
1⤵
PID:400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdge.exe

Path C:\Users\Admin\AppData\Roaming\MicrosoftEdge\MicrosoftEdge.exe
Size 540KB
SHA256 c4b75cdc84b5570235c4568fd085b2f82e3fa7ce16e39d56fddc821416129efb
MD5 eaa0ca9decc6b10f87a9ff57bbdd1941
SHA1 7e86c621d0401f4d3168c448d638c1f4e85ae5b2
SHA512 061217a50f40f372e25b707801a07f931900ab74cf951dd490249ceeb27b737717e37039c188db54a9aa4fae5f3b0a8236e13377c61552b5d45869995c8170d6
SSDEEP 6144:TsTjI4aO2DTy3Oxqk/5LDARfoz1Vib62ithQKaVymuabY+F4IFGqStKEbxI2:2I4aO2v5Pofoz1VltD9mi+F3YyEbxZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1540-32-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-35-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-34-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-36-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-37-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-38-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-8-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-9-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-10-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/1540-39-0x000001AEE2A80000-0x000001AEE2A81000-memory.dmp

Download

memory/2696-63-0x000000006FCA0000-0x000000006FCB0000-memory.dmp

Download

memory/2696-106-0x0000000001040000-0x0000000001061000-memory.dmp

Download

memory/2696-68-0x0000000001040000-0x0000000001061000-memory.dmp

Download

memory/2696-64-0x0000000077CB2000-0x0000000077CB3000-memory.dmp

Download

memory/2696-61-0x0000000001040000-0x0000000001061000-memory.dmp

Download

memory/2696-102-0x00000000077D0000-0x00000000077DA000-memory.dmp

Download

memory/2696-108-0x0000000005660000-0x0000000005670000-memory.dmp

Download

memory/2696-87-0x0000000005660000-0x0000000005670000-memory.dmp

Download

memory/2696-107-0x0000000075240000-0x00000000759F0000-memory.dmp

Download

memory/2696-75-0x0000000000990000-0x0000000000A1E000-memory.dmp

Download

memory/2696-74-0x0000000075240000-0x00000000759F0000-memory.dmp

Download

memory/2696-72-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/2696-66-0x0000000077CB3000-0x0000000077CB4000-memory.dmp

Download

memory/2696-111-0x0000000075240000-0x00000000759F0000-memory.dmp

Download

memory/3652-11-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3652-12-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3652-16-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3652-14-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3652-13-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3652-22-0x0000000003350000-0x0000000003371000-memory.dmp

Download

memory/3904-93-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3904-94-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3904-98-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/3904-96-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4152-51-0x0000000077CB2000-0x0000000077CB3000-memory.dmp

Download

memory/4152-49-0x00000000012E0000-0x0000000001301000-memory.dmp

Download

memory/4152-45-0x0000000001090000-0x00000000010B1000-memory.dmp

Download

memory/4152-54-0x0000000001090000-0x00000000010B1000-memory.dmp

Download

memory/4152-53-0x0000000077CB3000-0x0000000077CB4000-memory.dmp

Download

memory/4152-56-0x0000000000C70000-0x0000000000CA2000-memory.dmp

Download

memory/4152-48-0x000000006FCA0000-0x000000006FCB0000-memory.dmp

Download

memory/4184-79-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/4184-89-0x0000000000C70000-0x0000000000CA2000-memory.dmp

Download

memory/4184-88-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/4184-81-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4184-85-0x0000000077CB3000-0x0000000077CB4000-memory.dmp

Download

memory/4184-83-0x000000006FCA0000-0x000000006FCB0000-memory.dmp

Download

memory/4184-84-0x0000000077CB2000-0x0000000077CB3000-memory.dmp

Download

memory/5056-47-0x0000000075240000-0x00000000759F0000-memory.dmp

Download

memory/5056-60-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Download

memory/5056-26-0x000000006FCA0000-0x000000006FCB0000-memory.dmp

Download

memory/5056-25-0x0000000077CB3000-0x0000000077CB4000-memory.dmp

Download

memory/5056-76-0x0000000075240000-0x00000000759F0000-memory.dmp

Download

memory/5056-29-0x0000000077CB2000-0x0000000077CB3000-memory.dmp

Download

memory/5056-71-0x0000000077C41000-0x0000000077D61000-memory.dmp

Download

memory/5056-33-0x0000000007060000-0x00000000070C6000-memory.dmp

Download

memory/5056-40-0x00000000070D0000-0x00000000070E2000-memory.dmp

Download

memory/5056-24-0x0000000077CB2000-0x0000000077CB3000-memory.dmp

Download

memory/5056-41-0x00000000075E0000-0x000000000761C000-memory.dmp

Download

memory/5056-73-0x00000000066A0000-0x00000000066C1000-memory.dmp

Download

memory/5056-1-0x0000000000850000-0x00000000008DE000-memory.dmp

Download

memory/5056-23-0x00000000066A0000-0x00000000066C1000-memory.dmp

Download

memory/5056-21-0x00000000066A0000-0x00000000066C1000-memory.dmp

Download

memory/5056-18-0x00000000062A0000-0x00000000062BB000-memory.dmp

Download

memory/5056-7-0x0000000077C41000-0x0000000077D61000-memory.dmp

Download

memory/5056-5-0x0000000006BA0000-0x0000000006BDE000-memory.dmp

Download

memory/5056-4-0x0000000006300000-0x0000000006392000-memory.dmp

Download

memory/5056-3-0x0000000002CD0000-0x0000000002CE0000-memory.dmp

Download

memory/5056-2-0x0000000005720000-0x0000000005CC4000-memory.dmp

Download

memory/5056-0-0x0000000075240000-0x00000000759F0000-memory.dmp

Download