sectoprat | a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe
Size

445KB
MD5

4e23683093c8c129220769d219abf943
SHA1

ee911754e062ed6cd5f0f5e854ae72f647aacbcd
SHA256

a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444
SHA512

5cf1d273ec67a7ef9f15f26dc19c7fdfb7ca55ee1d4b6666d253cae9114aa48bdc3c3a46b3283553dcacfb4ffe0fdd149c651d8e29fbeb5da6f939b3066a8b31
SSDEEP

6144:JekG6S4KJiiEPhpbas7CdbWTExRYde0GsybfjRYHx7IlvDbm+NRASZ/:4kG6fTxasubCde0GxrRNlvDbvNyU/

Score

10^/10

sectoprat stealc zgrat rat stealer trojan

Malware Config

Extracted

Family

stealc

http://185.172.128.209

Attributes

url_path
/3cd2b41cbde8fc9c.php

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4404-127-0x000001F1C37B0000-0x000001F1C70A8000-memory.dmp	family_zgrat_v1
behavioral1/memory/4404-129-0x000001F1E1990000-0x000001F1E1AA0000-memory.dmp	family_zgrat_v1
behavioral1/memory/4404-133-0x000001F1C8EF0000-0x000001F1C8F14000-memory.dmp	family_zgrat_v1

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3240-170-0x0000000001300000-0x00000000013C6000-memory.dmp	family_sectoprat

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

u1ko.1.exea764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	u1ko.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe

Executes dropped EXE 4 IoCs

Processes:

u1ko.0.exeQg_Appv5.exeUniversalInstaller.exeu1ko.1.exe

pid process

2076 u1ko.0.exe
3368 Qg_Appv5.exe
1712 UniversalInstaller.exe
1828 u1ko.1.exe
Loads dropped DLL 2 IoCs

Processes:

UniversalInstaller.exe

pid process

1712 UniversalInstaller.exe
1712 UniversalInstaller.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

99 pastebin.com
97 pastebin.com

pid	process
2076	u1ko.0.exe
3368	Qg_Appv5.exe
1712	UniversalInstaller.exe
1828	u1ko.1.exe

pid	process
1712	UniversalInstaller.exe
1712	UniversalInstaller.exe

flow	ioc
99	pastebin.com
97	pastebin.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

UniversalInstaller.execmd.exe

description	pid	process	target process
PID 4560 set thread context of 4644	4560	UniversalInstaller.exe	cmd.exe
PID 4644 set thread context of 3240	4644	cmd.exe	MSBuild.exe

Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\GS_Debug.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\GS_Debug.job	cmd.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2884	2076	WerFault.exe	u1ko.0.exe
2320	2040	WerFault.exe	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

u1ko.1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1ko.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1ko.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u1ko.1.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.execmd.exeSystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

pid	process
3368	Qg_Appv5.exe
3368	Qg_Appv5.exe
3368	Qg_Appv5.exe
3368	Qg_Appv5.exe
3368	Qg_Appv5.exe
4560	UniversalInstaller.exe
4560	UniversalInstaller.exe
4560	UniversalInstaller.exe
4644	cmd.exe
4644	cmd.exe
4644	cmd.exe
4644	cmd.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

UniversalInstaller.execmd.exe

pid process

4560 UniversalInstaller.exe
4644 cmd.exe
4644 cmd.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 4404 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege 3240 MSBuild.exe
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

u1ko.1.exe

pid process

1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

u1ko.1.exe

pid process

1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
1828 u1ko.1.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Qg_Appv5.exeUniversalInstaller.exe

pid process

3368 Qg_Appv5.exe
4560 UniversalInstaller.exe
4560 UniversalInstaller.exe

pid	process
4560	UniversalInstaller.exe
4644	cmd.exe
4644	cmd.exe

description	pid	process
Token: SeDebugPrivilege	4404	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeDebugPrivilege	3240	MSBuild.exe

pid	process
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe

pid	process
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe
1828	u1ko.1.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exeQg_Appv5.exeUniversalInstaller.exeu1ko.1.execmd.exe

description	pid	process	target process
PID 2040 wrote to memory of 2076	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	u1ko.0.exe
PID 2040 wrote to memory of 2076	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	u1ko.0.exe
PID 2040 wrote to memory of 2076	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	u1ko.0.exe
PID 2040 wrote to memory of 3368	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	Qg_Appv5.exe
PID 2040 wrote to memory of 3368	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	Qg_Appv5.exe
PID 3368 wrote to memory of 1712	3368	Qg_Appv5.exe	UniversalInstaller.exe
PID 3368 wrote to memory of 1712	3368	Qg_Appv5.exe	UniversalInstaller.exe
PID 3368 wrote to memory of 1712	3368	Qg_Appv5.exe	UniversalInstaller.exe
PID 4560 wrote to memory of 4644	4560	UniversalInstaller.exe	cmd.exe
PID 4560 wrote to memory of 4644	4560	UniversalInstaller.exe	cmd.exe
PID 4560 wrote to memory of 4644	4560	UniversalInstaller.exe	cmd.exe
PID 2040 wrote to memory of 1828	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	u1ko.1.exe
PID 2040 wrote to memory of 1828	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	u1ko.1.exe
PID 2040 wrote to memory of 1828	2040	a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe	u1ko.1.exe
PID 4560 wrote to memory of 4644	4560	UniversalInstaller.exe	cmd.exe
PID 1828 wrote to memory of 4404	1828	u1ko.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 1828 wrote to memory of 4404	1828	u1ko.1.exe	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
PID 4644 wrote to memory of 3240	4644	cmd.exe	MSBuild.exe
PID 4644 wrote to memory of 3240	4644	cmd.exe	MSBuild.exe
PID 4644 wrote to memory of 3240	4644	cmd.exe	MSBuild.exe
PID 4644 wrote to memory of 3240	4644	cmd.exe	MSBuild.exe
PID 4644 wrote to memory of 3240	4644	cmd.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe
"C:\Users\Admin\AppData\Local\Temp\a764256c5d36a3339733437888bd756059fff4422e31697319ef54a08ed53444.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\u1ko.0.exe
"C:\Users\Admin\AppData\Local\Temp\u1ko.0.exe"
2⤵
- Executes dropped EXE
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1032
3⤵
- Program crash
PID:2884

C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368

C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712

C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe
4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3240

C:\Users\Admin\AppData\Local\Temp\u1ko.1.exe
"C:\Users\Admin\AppData\Local\Temp\u1ko.1.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828

C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1012
2⤵
- Program crash
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2076 -ip 2076
1⤵
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2040 -ip 2040
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\564205e7
Filesize
5.9MB

MD5
dcc26dd014bad9eafa9066d3781b615d

SHA1
b0cb8621ca58a196ac73bed4e525deacfaf2d836

SHA256
69502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3

SHA512
5a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\5e9e49a1
Filesize
1.4MB

MD5
5b71bc1c3e2a6bafdbbbee1a85758428

SHA1
4ad3f3e8fc37637683cf56c6c8688836b3be1bd4

SHA256
89741495b6175d7d07aaac5801186a7ff9187af52bc2ccff27613385e59340b1

SHA512
303991986a9fb2cbf2c529514f0a6699c20a9d9e46205e03c8ef30fe1695d78cc5bfc09af8e15aa4b8de31f41549edc7fd0252c0f0f653c90ef3d14af260cf76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
Filesize
14.7MB

MD5
6955715b6ff15bdc153a2431cc395cca

SHA1
272e1eec66a1871b300484b2200b507a4abe5420

SHA256
a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761

SHA512
cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dll
Filesize
1.6MB

MD5
8f75e17a8bf3de6e22e77b5586f8a869

SHA1
e0bf196cfc19a8772e003b9058bdc211b419b261

SHA256
5f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985

SHA512
5a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe
Filesize
2.4MB

MD5
9fb4770ced09aae3b437c1c6eb6d7334

SHA1
fe54b31b0db8665aa5b22bed147e8295afc88a03

SHA256
a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

SHA512
140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dll
Filesize
1.5MB

MD5
7d2f87123e63950159fb2c724e55bdab

SHA1
360f304a6311080e1fead8591cb4659a8d135f2d

SHA256
b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a

SHA512
6cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1ko.0.exe
Filesize
300KB

MD5
e965474beb540e3e06258c43394f3808

SHA1
62cf5e660080e94f7ab601fa5fb071431e17dbf9

SHA256
e7d01bd9be89df004023b65241047382885bb8f89df0f2f6be274bbb2f2eaf3f

SHA512
4cc04091fbfdeebf28f1eaeb6ac85e93af01214fc3a7b17de601761b5976615a2dbc9919d7eff6185720d3693701f699fe3daa70106dd1d41c4914c3f1a16e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\u1ko.1.exe
Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
memory/1828-125-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/1828-122-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/1828-112-0x0000000000400000-0x00000000008AD000-memory.dmp

Filesize
4.7MB

Download
memory/1828-74-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/2040-79-0x0000000000400000-0x0000000001A39000-memory.dmp

Filesize
22.2MB

Download
memory/2040-22-0x00000000037D0000-0x000000000383E000-memory.dmp

Filesize
440KB

Download
memory/2040-1-0x0000000001C30000-0x0000000001D30000-memory.dmp

Filesize
1024KB

Download
memory/2040-2-0x00000000037D0000-0x000000000383E000-memory.dmp

Filesize
440KB

Download
memory/2040-3-0x0000000000400000-0x0000000001A39000-memory.dmp

Filesize
22.2MB

Download
memory/2040-20-0x0000000000400000-0x0000000001A39000-memory.dmp

Filesize
22.2MB

Download
memory/2040-21-0x0000000001C30000-0x0000000001D30000-memory.dmp

Filesize
1024KB

Download
memory/2076-16-0x0000000001B30000-0x0000000001C30000-memory.dmp

Filesize
1024KB

Download
memory/2076-19-0x0000000000400000-0x0000000001A15000-memory.dmp

Filesize
22.1MB

Download
memory/2076-17-0x0000000003620000-0x0000000003647000-memory.dmp

Filesize
156KB

Download
memory/2076-18-0x0000000000400000-0x0000000001A15000-memory.dmp

Filesize
22.1MB

Download
memory/3240-173-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/3240-174-0x0000000005FC0000-0x0000000006564000-memory.dmp

Filesize
5.6MB

Download
memory/3240-166-0x0000000072FB0000-0x0000000074204000-memory.dmp

Filesize
18.3MB

Download
memory/3240-171-0x0000000072350000-0x0000000072B00000-memory.dmp

Filesize
7.7MB

Download
memory/3240-182-0x0000000072350000-0x0000000072B00000-memory.dmp

Filesize
7.7MB

Download
memory/3240-170-0x0000000001300000-0x00000000013C6000-memory.dmp

Filesize
792KB

Download
memory/3240-176-0x0000000005D10000-0x0000000005ED2000-memory.dmp

Filesize
1.8MB

Download
memory/3240-177-0x0000000005A10000-0x0000000005A60000-memory.dmp

Filesize
320KB

Download
memory/3240-183-0x0000000001620000-0x0000000001696000-memory.dmp

Filesize
472KB

Download
memory/3368-53-0x00007FF969FB0000-0x00007FF96A122000-memory.dmp

Filesize
1.4MB

Download
memory/3368-84-0x00007FF969FB0000-0x00007FF96A122000-memory.dmp

Filesize
1.4MB

Download
memory/3368-54-0x00007FF969FB0000-0x00007FF96A122000-memory.dmp

Filesize
1.4MB

Download
memory/3368-44-0x00007FF969FB0000-0x00007FF96A122000-memory.dmp

Filesize
1.4MB

Download
memory/3368-42-0x00007FF969FB0000-0x00007FF96A122000-memory.dmp

Filesize
1.4MB

Download
memory/3368-35-0x000001C528E20000-0x000001C528E21000-memory.dmp

Filesize
4KB

Download
memory/3368-36-0x00000000000E0000-0x0000000000FBD000-memory.dmp

Filesize
14.9MB

Download
memory/4404-130-0x000001F1C75D0000-0x000001F1C75E0000-memory.dmp

Filesize
64KB

Download
memory/4404-154-0x000001F1E7280000-0x000001F1E728A000-memory.dmp

Filesize
40KB

Download
memory/4404-129-0x000001F1E1990000-0x000001F1E1AA0000-memory.dmp

Filesize
1.1MB

Download
memory/4404-127-0x000001F1C37B0000-0x000001F1C70A8000-memory.dmp

Filesize
57.0MB

Download
memory/4404-131-0x000001F1C8EE0000-0x000001F1C8EEC000-memory.dmp

Filesize
48KB

Download
memory/4404-132-0x000001F1C7490000-0x000001F1C74A4000-memory.dmp

Filesize
80KB

Download
memory/4404-133-0x000001F1C8EF0000-0x000001F1C8F14000-memory.dmp

Filesize
144KB

Download
memory/4404-134-0x000001F1C8F60000-0x000001F1C8F6A000-memory.dmp

Filesize
40KB

Download
memory/4404-135-0x000001F1E17C0000-0x000001F1E1872000-memory.dmp

Filesize
712KB

Download
memory/4404-139-0x000001F1E1D80000-0x000001F1E1DF6000-memory.dmp

Filesize
472KB

Download
memory/4404-138-0x000001F1E1CA0000-0x000001F1E1D02000-memory.dmp

Filesize
392KB

Download
memory/4404-137-0x000001F1E1C10000-0x000001F1E1C8A000-memory.dmp

Filesize
488KB

Download
memory/4404-136-0x000001F1E1BE0000-0x000001F1E1C0A000-memory.dmp

Filesize
168KB

Download
memory/4404-140-0x000001F1C8F70000-0x000001F1C8F7A000-memory.dmp

Filesize
40KB

Download
memory/4404-144-0x000001F1E1E00000-0x000001F1E2100000-memory.dmp

Filesize
3.0MB

Download
memory/4404-181-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-180-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-149-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-148-0x000001F1E67E0000-0x000001F1E67E8000-memory.dmp

Filesize
32KB

Download
memory/4404-150-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-151-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-152-0x000001F1E6120000-0x000001F1E6158000-memory.dmp

Filesize
224KB

Download
memory/4404-153-0x000001F1E60F0000-0x000001F1E60FE000-memory.dmp

Filesize
56KB

Download
memory/4404-128-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-155-0x000001F1E7000000-0x000001F1E7022000-memory.dmp

Filesize
136KB

Download
memory/4404-156-0x000001F1E77C0000-0x000001F1E7CE8000-memory.dmp

Filesize
5.2MB

Download
memory/4404-161-0x000001F1E7020000-0x000001F1E702C000-memory.dmp

Filesize
48KB

Download
memory/4404-160-0x000001F1E7070000-0x000001F1E70C0000-memory.dmp

Filesize
320KB

Download
memory/4404-159-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-162-0x000001F1E70C0000-0x000001F1E70E2000-memory.dmp

Filesize
136KB

Download
memory/4404-163-0x000001F1E70F0000-0x000001F1E710E000-memory.dmp

Filesize
120KB

Download
memory/4404-179-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-126-0x00007FF968A90000-0x00007FF969551000-memory.dmp

Filesize
10.8MB

Download
memory/4404-178-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4404-172-0x00007FF968A90000-0x00007FF969551000-memory.dmp

Filesize
10.8MB

Download
memory/4404-175-0x000001F1C8EA0000-0x000001F1C8EB0000-memory.dmp

Filesize
64KB

Download
memory/4560-86-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4560-62-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4560-61-0x00007FF988BD0000-0x00007FF988DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4560-60-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4644-105-0x00007FF988BD0000-0x00007FF988DC5000-memory.dmp

Filesize
2.0MB

Download
memory/4644-88-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4644-106-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4644-107-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4644-167-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4644-147-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download
memory/4644-146-0x0000000072D00000-0x0000000072E7B000-memory.dmp

Filesize
1.5MB

Download