sectoprat | 481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e

Analysis

max time kernel
279s
max time network
286s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
Size

412KB
MD5

19e93cdbbe05d789bc11c8f6c24357ab
SHA1

d436779f72b2c17207668955b9cb64055650fd23
SHA256

481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e
SHA512

33f75ff405d8adc693cb154d86899cd59f83608a2cdd2b356308fc56395b70e1a2f48fa9c08d9daf59cb456f5a5b3f1a79b143dd8b0f4de4f84b1ea51165e342
SSDEEP

6144:0GlYLHoDRsJI9IG2AUXj0b8fN1aj5OhsMXmhvDKX1XuEc1:0GlYzoUOWAm04fN1a4nXm+1eP1

Score

10^/10

sectoprat stealc zgrat rat spyware stealer trojan

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/3036-154-0x0000000000D80000-0x0000000004678000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-174-0x000000001E1F0000-0x000000001E214000-memory.dmp	family_zgrat_v1
behavioral1/memory/3036-170-0x000000001EF40000-0x000000001F050000-memory.dmp	family_zgrat_v1

Detects Arechclient2 RAT 1 IoCs

Arechclient2.

resource	yara_rule
behavioral1/memory/1740-218-0x0000000000400000-0x00000000004C6000-memory.dmp	MALWARE_Win_Arechclient

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

resource	yara_rule
behavioral1/memory/1740-218-0x0000000000400000-0x00000000004C6000-memory.dmp	family_sectoprat

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
2124	u27s.0.exe
2620	Qg_Appv5.exe
1696	UniversalInstaller.exe
2976	u27s.1.exe
1816	UniversalInstaller.exe

Loads dropped DLL 15 IoCs

pid	Process
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
1696	UniversalInstaller.exe
1696	UniversalInstaller.exe
1696	UniversalInstaller.exe
1816	UniversalInstaller.exe
1816	UniversalInstaller.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1816 set thread context of 1516	1816	UniversalInstaller.exe	33
PID 1516 set thread context of 1740	1516	cmd.exe	37

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\GS_Debug.job	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u27s.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u27s.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u27s.1.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2620	Qg_Appv5.exe
2620	Qg_Appv5.exe
2620	Qg_Appv5.exe
1696	UniversalInstaller.exe
1816	UniversalInstaller.exe
1816	UniversalInstaller.exe
1516	cmd.exe
1516	cmd.exe
3036	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
3036	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
3036	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
3036	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
3036	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
1740	MSBuild.exe
1740	MSBuild.exe
1740	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1816	UniversalInstaller.exe
1516	cmd.exe
1516	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	1740	MSBuild.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe
2976	u27s.1.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2620	Qg_Appv5.exe
1696	UniversalInstaller.exe
1696	UniversalInstaller.exe
1816	UniversalInstaller.exe
1816	UniversalInstaller.exe
1740	MSBuild.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2124	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	28
PID 2872 wrote to memory of 2124	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	28
PID 2872 wrote to memory of 2124	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	28
PID 2872 wrote to memory of 2124	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	28
PID 2872 wrote to memory of 2620	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	29
PID 2872 wrote to memory of 2620	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	29
PID 2872 wrote to memory of 2620	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	29
PID 2872 wrote to memory of 2620	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	29
PID 2872 wrote to memory of 2976	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	30
PID 2872 wrote to memory of 2976	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	30
PID 2872 wrote to memory of 2976	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	30
PID 2872 wrote to memory of 2976	2872	481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe	30
PID 2620 wrote to memory of 1696	2620	Qg_Appv5.exe	31
PID 2620 wrote to memory of 1696	2620	Qg_Appv5.exe	31
PID 2620 wrote to memory of 1696	2620	Qg_Appv5.exe	31
PID 2620 wrote to memory of 1696	2620	Qg_Appv5.exe	31
PID 2620 wrote to memory of 1696	2620	Qg_Appv5.exe	31
PID 2620 wrote to memory of 1696	2620	Qg_Appv5.exe	31
PID 2620 wrote to memory of 1696	2620	Qg_Appv5.exe	31
PID 1696 wrote to memory of 1816	1696	UniversalInstaller.exe	32
PID 1696 wrote to memory of 1816	1696	UniversalInstaller.exe	32
PID 1696 wrote to memory of 1816	1696	UniversalInstaller.exe	32
PID 1696 wrote to memory of 1816	1696	UniversalInstaller.exe	32
PID 1696 wrote to memory of 1816	1696	UniversalInstaller.exe	32
PID 1696 wrote to memory of 1816	1696	UniversalInstaller.exe	32
PID 1696 wrote to memory of 1816	1696	UniversalInstaller.exe	32
PID 1816 wrote to memory of 1516	1816	UniversalInstaller.exe	33
PID 1816 wrote to memory of 1516	1816	UniversalInstaller.exe	33
PID 1816 wrote to memory of 1516	1816	UniversalInstaller.exe	33
PID 1816 wrote to memory of 1516	1816	UniversalInstaller.exe	33
PID 1816 wrote to memory of 1516	1816	UniversalInstaller.exe	33
PID 2976 wrote to memory of 3036	2976	u27s.1.exe	35
PID 2976 wrote to memory of 3036	2976	u27s.1.exe	35
PID 2976 wrote to memory of 3036	2976	u27s.1.exe	35
PID 2976 wrote to memory of 3036	2976	u27s.1.exe	35
PID 1516 wrote to memory of 1740	1516	cmd.exe	37
PID 1516 wrote to memory of 1740	1516	cmd.exe	37
PID 1516 wrote to memory of 1740	1516	cmd.exe	37
PID 1516 wrote to memory of 1740	1516	cmd.exe	37
PID 1516 wrote to memory of 1740	1516	cmd.exe	37
PID 1516 wrote to memory of 1740	1516	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe
"C:\Users\Admin\AppData\Local\Temp\481c134e037ef6f14fd93ce2195e25fc7ee64eef05b0aabef1a8da173571258e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\u27s.0.exe
  "C:\Users\Admin\AppData\Local\Temp\u27s.0.exe"
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
  "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
    C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
      C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        5⤵
        Suspicious use of SetThreadContext
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:1516
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1740
- C:\Users\Admin\AppData\Local\Temp\u27s.1.exe
  "C:\Users\Admin\AppData\Local\Temp\u27s.1.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
    "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Canon_Inc_IC\UniversalInstaller\ServiceLog\CANON_UIX_SERVICELOG_20240418223525.TXT

Filesize
45B

MD5
5305ffc10aa3e3f48702619f80fe47af

SHA1
38aff0dafdb22dd6a8c6c1694c68beda30fee080

SHA256
9c8a4906bcab16893dd91cac0d3abf2448994a9397cccc9446ccf2751d1ad859

SHA512
765cb8e2d0ffe446d548e5e76e36ff8b7db871681148905e0e2324f443a010f6c4b261b6148dd2d42bbb840205b4d86fea7ff6eba225613c41532225dd6d20c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\a34b5051478c01d83934dd5b0120757f7e5ff041b03ce291cb3621788d299269\83e6c917466f4cdb8b5c415dd61a4ed3.tmp

Filesize
1KB

MD5
675467cbeeddd48a71f28cab141c409b

SHA1
1a8a665faa851da2646dc24b731d2ee2e48b09b7

SHA256
d63ea0daefd1acad8bd5326d604638640103ac99a550be39cd912c534d400564

SHA512
472b7caa6bdb949bcafdc1e2aec22a045b9ebad7300784b51c2b2e4c9fed63faeb34835e386ca3cff322423ebca68de26a895c9edbfc337a292634c96ddb496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe

Filesize
14.7MB

MD5
6955715b6ff15bdc153a2431cc395cca

SHA1
272e1eec66a1871b300484b2200b507a4abe5420

SHA256
a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

SHA512
cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll

Filesize
1.6MB

MD5
8f75e17a8bf3de6e22e77b5586f8a869

SHA1
e0bf196cfc19a8772e003b9058bdc211b419b261

SHA256
5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

SHA512
5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe

Filesize
2.4MB

MD5
9fb4770ced09aae3b437c1c6eb6d7334

SHA1
fe54b31b0db8665aa5b22bed147e8295afc88a03

SHA256
a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

SHA512
140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll

Filesize
1.5MB

MD5
7d2f87123e63950159fb2c724e55bdab

SHA1
360f304a6311080e1fead8591cb4659a8d135f2d

SHA256
b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

SHA512
6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtf

Filesize
24KB

MD5
ff36ebcf134c8846aea77446867e5bc6

SHA1
53fdf2c0bec711e377edb4f97cd147728fb568f6

SHA256
e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

SHA512
b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xml

Filesize
1.3MB

MD5
2d8de35aa00138b2bfc4fb0fc3d0f58b

SHA1
28c2d84e01815702c230da456aaa17c7d2519186

SHA256
19340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac

SHA512
378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128

Download Submit
C:\Users\Admin\AppData\Local\Temp\e5720449

Filesize
5.9MB

MD5
dcc26dd014bad9eafa9066d3781b615d

SHA1
b0cb8621ca58a196ac73bed4e525deacfaf2d836

SHA256
69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

SHA512
5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\f31fc5f7

Filesize
1.4MB

MD5
b3ef791c26879aa11ac7c0cfde51aa68

SHA1
11251cc3445e8a0d3ca074546168cc309fe46a81

SHA256
b656d342cde0fca728055018d8483c6ffab076fe443503c8fc690ac46ebf25b8

SHA512
f51dda7bbbe574a2f09926786c73f0b217026c570c526d70bffba12299da71a62dea9b38da69efe6dcb107def51a8229fb4d9d74e783920ce823a672ab3311b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
e93bb741ff4c5f65765f887a944cda39

SHA1
41f0a8aec0dec86ed92ea1e0919219c009cb19cb

SHA256
99e05ad9073754e1612705b443dfb3f76e3aef6b126e2cb327e27bd288add43f

SHA512
bff4c15dd3db47fee6b8ec36b600185721d784c1433f116b141ba5488e267635c2a07fb4e4a7118a312b979727cee3b619978d4d378c1dac5cb0e8f570471b50

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCCF2.tmp

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\u27s.0.exe

Filesize
306KB

MD5
9e7bd4e6b0220bbb8c4068a02939e692

SHA1
92b8c83e84d6823bf4cf5238f368c27e5243241d

SHA256
a547ce72c56e28616970d53b15e05cf4532a20384cae7a72b8428789a48028ef

SHA512
7c1a0dcdcbeb988679ad24cbef85bd0b3f6c6c41c8699d506be3a1d6b0542fff0f6ec85eb53fe98278f787cd108771e2d168e2a9080327706edc629c41f57522

Download Submit
\Users\Admin\AppData\Local\Temp\u27s.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
memory/1516-135-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1516-149-0x00000000778D0000-0x0000000077A79000-memory.dmp

Filesize
1.7MB

Download
memory/1516-152-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1516-207-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1516-153-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1516-210-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1516-206-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1696-90-0x0000000074240000-0x00000000743B4000-memory.dmp

Filesize
1.5MB

Download
memory/1696-91-0x00000000778D0000-0x0000000077A79000-memory.dmp

Filesize
1.7MB

Download
memory/1740-219-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-220-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/1740-212-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1740-211-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1740-209-0x0000000072E50000-0x0000000073EB2000-memory.dmp

Filesize
16.4MB

Download
memory/1740-242-0x0000000004DC0000-0x0000000004E00000-memory.dmp

Filesize
256KB

Download
memory/1740-239-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1740-218-0x0000000000400000-0x00000000004C6000-memory.dmp

Filesize
792KB

Download
memory/1816-129-0x00000000778D0000-0x0000000077A79000-memory.dmp

Filesize
1.7MB

Download
memory/1816-130-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1816-133-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/1816-118-0x0000000074190000-0x0000000074304000-memory.dmp

Filesize
1.5MB

Download
memory/2124-23-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2124-21-0x00000000001B0000-0x00000000001D7000-memory.dmp

Filesize
156KB

Download
memory/2124-22-0x0000000000400000-0x000000000084E000-memory.dmp

Filesize
4.3MB

Download
memory/2124-20-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/2620-40-0x0000000000400000-0x00000000012DD000-memory.dmp

Filesize
14.9MB

Download
memory/2620-131-0x000007FEF6500000-0x000007FEF6658000-memory.dmp

Filesize
1.3MB

Download
memory/2620-50-0x000007FEF6500000-0x000007FEF6658000-memory.dmp

Filesize
1.3MB

Download
memory/2620-48-0x000007FEF6500000-0x000007FEF6658000-memory.dmp

Filesize
1.3MB

Download
memory/2620-76-0x000007FEF6500000-0x000007FEF6658000-memory.dmp

Filesize
1.3MB

Download
memory/2620-41-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2872-27-0x0000000075180000-0x0000000075185000-memory.dmp

Filesize
20KB

Download
memory/2872-29-0x0000000074D80000-0x0000000074D90000-memory.dmp

Filesize
64KB

Download
memory/2872-1-0x0000000002CE0000-0x0000000002DE0000-memory.dmp

Filesize
1024KB

Download
memory/2872-75-0x0000000000400000-0x0000000002C4A000-memory.dmp

Filesize
40.3MB

Download
memory/2872-24-0x0000000000400000-0x0000000002C4A000-memory.dmp

Filesize
40.3MB

Download
memory/2872-3-0x0000000000400000-0x0000000002C4A000-memory.dmp

Filesize
40.3MB

Download
memory/2872-2-0x00000000002D0000-0x000000000033D000-memory.dmp

Filesize
436KB

Download
memory/2976-80-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2976-148-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/3036-154-0x0000000000D80000-0x0000000004678000-memory.dmp

Filesize
57.0MB

Download
memory/3036-184-0x00000000200A0000-0x00000000203A0000-memory.dmp

Filesize
3.0MB

Download
memory/3036-187-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/3036-186-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/3036-188-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-189-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-191-0x0000000005BC0000-0x0000000005BE2000-memory.dmp

Filesize
136KB

Download
memory/3036-190-0x0000000005BB0000-0x0000000005BBA000-memory.dmp

Filesize
40KB

Download
memory/3036-196-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-195-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download
memory/3036-194-0x0000000005BE0000-0x0000000005BEC000-memory.dmp

Filesize
48KB

Download
memory/3036-198-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-203-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-202-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/3036-201-0x0000000000700000-0x000000000070A000-memory.dmp

Filesize
40KB

Download
memory/3036-204-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-205-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-180-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download
memory/3036-176-0x000000001E630000-0x000000001E65A000-memory.dmp

Filesize
168KB

Download
memory/3036-177-0x000000001EBC0000-0x000000001EC72000-memory.dmp

Filesize
712KB

Download
memory/3036-178-0x000000001E660000-0x000000001E6DA000-memory.dmp

Filesize
488KB

Download
memory/3036-179-0x0000000000A40000-0x0000000000AA2000-memory.dmp

Filesize
392KB

Download
memory/3036-175-0x000000001E220000-0x000000001E22A000-memory.dmp

Filesize
40KB

Download
memory/3036-170-0x000000001EF40000-0x000000001F050000-memory.dmp

Filesize
1.1MB

Download
memory/3036-174-0x000000001E1F0000-0x000000001E214000-memory.dmp

Filesize
144KB

Download
memory/3036-173-0x0000000000D70000-0x0000000000D84000-memory.dmp

Filesize
80KB

Download
memory/3036-171-0x0000000000B00000-0x0000000000B10000-memory.dmp

Filesize
64KB

Download
memory/3036-172-0x000000001E0D0000-0x000000001E0DC000-memory.dmp

Filesize
48KB

Download
memory/3036-169-0x000000001E6E0000-0x000000001E760000-memory.dmp

Filesize
512KB

Download
memory/3036-150-0x000007FEF5C70000-0x000007FEF665C000-memory.dmp

Filesize
9.9MB

Download