sectoprat | 538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe
Size

497KB
MD5

aff1866a4c9bf3226a842da8c12f7606
SHA1

0b51a9f10017b8cadb5903003dbc0d9e558760a3
SHA256

538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba
SHA512

acc32bb2acbadfef4cea8fb98eac80588fd84dbafbcc28702d0af83e4691ef1473252c71d6b1fb12909b0b5c580a1dc3c9c09299a8d051c97473150dedc6b4a8
SSDEEP

12288:VBy70w/OnfLYTOOc411sVyL8/TtPnAUaPkcX38rese4uP:VBayfohBf5YJPnfXcXaeR4uP

Score

10^/10

sectoprat stealc rat stealer trojan

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/464-107-0x0000000000410000-0x00000000004D6000-memory.dmp	family_sectoprat

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe

Executes dropped EXE 5 IoCs

Processes:

u230.0.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exeu230.1.exe

pid process

1052 u230.0.exe
260 Qg_Appv5.exe
3772 UniversalInstaller.exe
3508 UniversalInstaller.exe
2960 u230.1.exe
Loads dropped DLL 4 IoCs

Processes:

UniversalInstaller.exeUniversalInstaller.exe

pid process

3772 UniversalInstaller.exe
3772 UniversalInstaller.exe
3508 UniversalInstaller.exe
3508 UniversalInstaller.exe

pid	process
1052	u230.0.exe
260	Qg_Appv5.exe
3772	UniversalInstaller.exe
3508	UniversalInstaller.exe
2960	u230.1.exe

pid	process
3772	UniversalInstaller.exe
3772	UniversalInstaller.exe
3508	UniversalInstaller.exe
3508	UniversalInstaller.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

UniversalInstaller.execmd.exe

description	pid	process	target process
PID 3508 set thread context of 3424	3508	UniversalInstaller.exe	cmd.exe
PID 3424 set thread context of 464	3424	cmd.exe	MSBuild.exe

Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\GS_Debug.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\GS_Debug.job	cmd.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
376	1052	WerFault.exe	u230.0.exe
2352	2700	WerFault.exe	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

u230.1.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u230.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u230.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u230.1.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exeMSBuild.exe

pid	process
260	Qg_Appv5.exe
260	Qg_Appv5.exe
260	Qg_Appv5.exe
260	Qg_Appv5.exe
3772	UniversalInstaller.exe
3508	UniversalInstaller.exe
3508	UniversalInstaller.exe
3424	cmd.exe
3424	cmd.exe
464	MSBuild.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

UniversalInstaller.execmd.exe

pid process

3508 UniversalInstaller.exe
3424 cmd.exe
3424 cmd.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

MSBuild.exe

description pid process

Token: SeDebugPrivilege 464 MSBuild.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

u230.1.exe

pid process

2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

u230.1.exe

pid process

2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
2960 u230.1.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exeMSBuild.exe

pid process

260 Qg_Appv5.exe
3772 UniversalInstaller.exe
3772 UniversalInstaller.exe
3508 UniversalInstaller.exe
3508 UniversalInstaller.exe
464 MSBuild.exe

pid	process
3508	UniversalInstaller.exe
3424	cmd.exe
3424	cmd.exe

description	pid	process
Token: SeDebugPrivilege	464	MSBuild.exe

pid	process
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe

pid	process
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe
2960	u230.1.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.execmd.exe

description	pid	process	target process
PID 2700 wrote to memory of 1052	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	u230.0.exe
PID 2700 wrote to memory of 1052	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	u230.0.exe
PID 2700 wrote to memory of 1052	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	u230.0.exe
PID 2700 wrote to memory of 260	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	Qg_Appv5.exe
PID 2700 wrote to memory of 260	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	Qg_Appv5.exe
PID 260 wrote to memory of 3772	260	Qg_Appv5.exe	UniversalInstaller.exe
PID 260 wrote to memory of 3772	260	Qg_Appv5.exe	UniversalInstaller.exe
PID 260 wrote to memory of 3772	260	Qg_Appv5.exe	UniversalInstaller.exe
PID 3772 wrote to memory of 3508	3772	UniversalInstaller.exe	UniversalInstaller.exe
PID 3772 wrote to memory of 3508	3772	UniversalInstaller.exe	UniversalInstaller.exe
PID 3772 wrote to memory of 3508	3772	UniversalInstaller.exe	UniversalInstaller.exe
PID 3508 wrote to memory of 3424	3508	UniversalInstaller.exe	cmd.exe
PID 3508 wrote to memory of 3424	3508	UniversalInstaller.exe	cmd.exe
PID 3508 wrote to memory of 3424	3508	UniversalInstaller.exe	cmd.exe
PID 3508 wrote to memory of 3424	3508	UniversalInstaller.exe	cmd.exe
PID 3424 wrote to memory of 464	3424	cmd.exe	MSBuild.exe
PID 3424 wrote to memory of 464	3424	cmd.exe	MSBuild.exe
PID 3424 wrote to memory of 464	3424	cmd.exe	MSBuild.exe
PID 3424 wrote to memory of 464	3424	cmd.exe	MSBuild.exe
PID 3424 wrote to memory of 464	3424	cmd.exe	MSBuild.exe
PID 2700 wrote to memory of 2960	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	u230.1.exe
PID 2700 wrote to memory of 2960	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	u230.1.exe
PID 2700 wrote to memory of 2960	2700	538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe	u230.1.exe

C:\Users\Admin\AppData\Local\Temp\538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe
"C:\Users\Admin\AppData\Local\Temp\538af20cc47b76f65a2bb6daed037b48574a6f5feb21c22315633b4c451a10ba.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2700

C:\Users\Admin\AppData\Local\Temp\u230.0.exe
"C:\Users\Admin\AppData\Local\Temp\u230.0.exe"
2⤵
- Executes dropped EXE
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 1052
3⤵
- Program crash
PID:376

C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:260

C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3772

C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:464

C:\Users\Admin\AppData\Local\Temp\u230.1.exe
"C:\Users\Admin\AppData\Local\Temp\u230.1.exe"
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 772
2⤵
- Program crash
PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1052 -ip 1052
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2700 -ip 2700
1⤵
PID:388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9fe38fc1
Filesize
5.9MB

MD5
dcc26dd014bad9eafa9066d3781b615d

SHA1
b0cb8621ca58a196ac73bed4e525deacfaf2d836

SHA256
69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

SHA512
5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
Filesize
14.7MB

MD5
6955715b6ff15bdc153a2431cc395cca

SHA1
272e1eec66a1871b300484b2200b507a4abe5420

SHA256
a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

SHA512
cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll
Filesize
1.6MB

MD5
8f75e17a8bf3de6e22e77b5586f8a869

SHA1
e0bf196cfc19a8772e003b9058bdc211b419b261

SHA256
5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

SHA512
5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
Filesize
2.4MB

MD5
9fb4770ced09aae3b437c1c6eb6d7334

SHA1
fe54b31b0db8665aa5b22bed147e8295afc88a03

SHA256
a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

SHA512
140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll
Filesize
1.5MB

MD5
7d2f87123e63950159fb2c724e55bdab

SHA1
360f304a6311080e1fead8591cb4659a8d135f2d

SHA256
b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

SHA512
6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtf
Filesize
24KB

MD5
ff36ebcf134c8846aea77446867e5bc6

SHA1
53fdf2c0bec711e377edb4f97cd147728fb568f6

SHA256
e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9

SHA512
b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xml
Filesize
1.3MB

MD5
2d8de35aa00138b2bfc4fb0fc3d0f58b

SHA1
28c2d84e01815702c230da456aaa17c7d2519186

SHA256
19340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac

SHA512
378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128

Download Submit
C:\Users\Admin\AppData\Local\Temp\b4a095bd
Filesize
1.4MB

MD5
48bd0ec9408fc503635c8834911c2a85

SHA1
59245351ead7df25480bdcacfba689fcc97536d0

SHA256
73284afd54168e18a54675ffac47c874651b84cb80317bb1f9283def141ea5d5

SHA512
2aeb3c4621f790f0ad262df690c459d191179d921b22a1e5f80a05621505bcf966d3e9d2bb64f928ee1498820d167438935e69384a61a4750c5b2b8a7d906fa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Filesize
2KB

MD5
baefc25f9b5bcb0f5b72a6ef15f18fc4

SHA1
dea46a5ea5356df0371ec571ba81b4ea9aef4d90

SHA256
797048ab1257d174e56883ddf505e0b1295148bdf216879b097c96a1ba15f109

SHA512
e55fe0663f1abd0e22d73c80364ff69458cc04e203bb3695d3cbc9cbc9e3375398d6f257b98becedfca8a6ffe9956f2979dc960eff414072ac808e1ef29137a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Filesize
3KB

MD5
b0b303877271713c8cb31a054ea74034

SHA1
c4cbd68c08ef17b2853a896aa1214298d3e0785c

SHA256
3a26ce012994dc6ce88ad5f3c34fdbc1c0faff1a47d002f8c8cb0cb17828bc96

SHA512
01e71cb75caa0334ff9cc82dfd4438578c5fb5d8ef0b061a0f5243c160f4e305c61e529e28f0ed234cdad5eac9dafcd31bcbe9d83f4d1e023cf7428cd4843b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1A27.tmp
Filesize
20KB

MD5
42c395b8db48b6ce3d34c301d1eba9d5

SHA1
b7cfa3de344814bec105391663c0df4a74310996

SHA256
5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d

SHA512
7b9214db96e9bec8745b4161a41c4c0520cdda9950f0cd3f12c7744227a25d639d07c0dd68b552cf1e032181c2e4f8297747f27bad6c7447b0f415a86bd82845

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1A4A.tmp
Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\u230.0.exe
Filesize
352KB

MD5
9ebdfe435d245f4c3cd4adb0f9677450

SHA1
ba3f7f7f77c7f4bd36ff11fea2c426d166e9ecc2

SHA256
42719dcc40d5fab2dc2d21ae0379652996e264b9633500fb9ba8786fe90ae5aa

SHA512
ed9dfb108fcd8ec59fb393ce16c9455057f89ae120b05555abea254a6bbdb1231ab865562afd20dc7283dc55c52a57ce993b1b9db0ffcaf4c67a18652a57d573

Download Submit
C:\Users\Admin\AppData\Local\Temp\u230.1.exe
Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
memory/260-86-0x00007FF801B40000-0x00007FF801CB2000-memory.dmp

Filesize
1.4MB

Download
memory/260-45-0x00007FF801B40000-0x00007FF801CB2000-memory.dmp

Filesize
1.4MB

Download
memory/260-47-0x00007FF801B40000-0x00007FF801CB2000-memory.dmp

Filesize
1.4MB

Download
memory/260-56-0x00007FF801B40000-0x00007FF801CB2000-memory.dmp

Filesize
1.4MB

Download
memory/260-39-0x0000000000210000-0x00000000010ED000-memory.dmp

Filesize
14.9MB

Download
memory/260-38-0x0000020678010000-0x0000020678011000-memory.dmp

Filesize
4KB

Download
memory/464-176-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/464-110-0x0000000005140000-0x00000000056E4000-memory.dmp

Filesize
5.6MB

Download
memory/464-114-0x0000000004D10000-0x0000000004D86000-memory.dmp

Filesize
472KB

Download
memory/464-113-0x0000000004BC0000-0x0000000004C10000-memory.dmp

Filesize
320KB

Download
memory/464-112-0x0000000004E60000-0x0000000005022000-memory.dmp

Filesize
1.8MB

Download
memory/464-116-0x0000000005850000-0x000000000586E000-memory.dmp

Filesize
120KB

Download
memory/464-111-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/464-115-0x0000000005D20000-0x000000000624C000-memory.dmp

Filesize
5.2MB

Download
memory/464-109-0x0000000004AF0000-0x0000000004B82000-memory.dmp

Filesize
584KB

Download
memory/464-108-0x0000000073470000-0x0000000073C20000-memory.dmp

Filesize
7.7MB

Download
memory/464-107-0x0000000000410000-0x00000000004D6000-memory.dmp

Filesize
792KB

Download
memory/464-117-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/464-150-0x0000000073470000-0x0000000073C20000-memory.dmp

Filesize
7.7MB

Download
memory/464-104-0x00000000717C0000-0x0000000072A14000-memory.dmp

Filesize
18.3MB

Download
memory/464-136-0x0000000007120000-0x000000000712A000-memory.dmp

Filesize
40KB

Download
memory/1052-16-0x0000000000400000-0x0000000001A23000-memory.dmp

Filesize
22.1MB

Download
memory/1052-15-0x0000000000400000-0x0000000001A23000-memory.dmp

Filesize
22.1MB

Download
memory/1052-14-0x0000000001B80000-0x0000000001BA7000-memory.dmp

Filesize
156KB

Download
memory/1052-13-0x0000000001D90000-0x0000000001E90000-memory.dmp

Filesize
1024KB

Download
memory/2700-2-0x00000000037D0000-0x000000000383E000-memory.dmp

Filesize
440KB

Download
memory/2700-1-0x0000000001C30000-0x0000000001D30000-memory.dmp

Filesize
1024KB

Download
memory/2700-85-0x0000000000400000-0x0000000001A48000-memory.dmp

Filesize
22.3MB

Download
memory/2700-156-0x0000000000400000-0x0000000001A48000-memory.dmp

Filesize
22.3MB

Download
memory/2700-3-0x0000000000400000-0x0000000001A48000-memory.dmp

Filesize
22.3MB

Download
memory/2700-17-0x0000000000400000-0x0000000001A48000-memory.dmp

Filesize
22.3MB

Download
memory/2700-19-0x00000000037D0000-0x000000000383E000-memory.dmp

Filesize
440KB

Download
memory/2700-20-0x0000000001C30000-0x0000000001D30000-memory.dmp

Filesize
1024KB

Download
memory/2960-177-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/2960-151-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/3424-101-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3424-100-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3424-94-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3424-93-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3424-92-0x00007FF821370000-0x00007FF821565000-memory.dmp

Filesize
2.0MB

Download
memory/3424-90-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3508-88-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3508-84-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3508-83-0x00007FF821370000-0x00007FF821565000-memory.dmp

Filesize
2.0MB

Download
memory/3508-82-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download
memory/3772-67-0x00007FF821370000-0x00007FF821565000-memory.dmp

Filesize
2.0MB

Download
memory/3772-66-0x0000000072C20000-0x0000000072D9B000-memory.dmp

Filesize
1.5MB

Download