quasar | 62ae14d3dd02e1b12d50084d22ca02ada727f525de08f77ed932deb7d1db7f01

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CATALOGUE2024.GBLTD.exe
Size

1.1MB
MD5

d276007d99a3f3aa1f0c9d85857f580b
SHA1

d2a920b76ceb676c5cced1504bea5056824c942d
SHA256

4b32b987a1815005b4cce599f2691cf7600433da1886a3e4d79fa80ac85df8d7
SHA512

ba1fb1e882c3d4f86d2cb02fe2b7883de1b47bb16fb9e3e418d36a77f8d1e87fb13a4df2557db909ee0b4896f38fda0026ca8002d19c1b26e89c090bec906639
SSDEEP

24576:peq3eRCl8rvXzpmsCraU8hgHjUBE5zxLv0SPuvi3lnQUpxLJY:IRCirbjU8hgDU6CWoiWixO

Score

10^/10

quasar venomrat shanjqhandohdbt4 discovery evasion execution rat rootkit spyware stealer trojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

ShanjQhandohDBT4

127.0.0.1:4782

Mutex

VNM_MUTEX_TsedL3VlE1RYgzxmD0

Attributes

encryption_key
n36uZkPlhyNINnnTiI80
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Corporation
subdirectory
SubDir

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/836-20-0x0000000000400000-0x000000000048C000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

MSBuild.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	MSBuild.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	MSBuild.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	MSBuild.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/836-20-0x0000000000400000-0x000000000048C000-memory.dmp	family_quasar

VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
rat rootkit stealer venomrat
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3180 powershell.exe

pid	process
3180	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CATALOGUE2024.GBLTD.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	CATALOGUE2024.GBLTD.exe

Executes dropped EXE 1 IoCs

Processes:

Client.exe

pid process

5100 Client.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

28 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

CATALOGUE2024.GBLTD.exe

description pid process target process

PID 4704 set thread context of 836 4704 CATALOGUE2024.GBLTD.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5100	Client.exe

flow	ioc
28	ip-api.com

description	pid	process	target process
PID 4704 set thread context of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exeClient.exeMSBuild.exeschtasks.exeMSBuild.execmd.exechcp.comCATALOGUE2024.GBLTD.exepowershell.execmd.execmd.exeschtasks.exePING.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CATALOGUE2024.GBLTD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

PING.EXE

pid process

2476 PING.EXE
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2476 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3088 schtasks.exe
4020 schtasks.exe

pid	process
2476	PING.EXE

pid	process
2476	PING.EXE

pid	process
3088	schtasks.exe
4020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

CATALOGUE2024.GBLTD.exepowershell.exepowershell.exeMSBuild.exe

pid	process
4704	CATALOGUE2024.GBLTD.exe
4704	CATALOGUE2024.GBLTD.exe
4704	CATALOGUE2024.GBLTD.exe
4704	CATALOGUE2024.GBLTD.exe
4704	CATALOGUE2024.GBLTD.exe
3180	powershell.exe
3180	powershell.exe
4556	powershell.exe
4556	powershell.exe
836	MSBuild.exe
836	MSBuild.exe
836	MSBuild.exe
836	MSBuild.exe
836	MSBuild.exe
836	MSBuild.exe
836	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

CATALOGUE2024.GBLTD.exepowershell.exeMSBuild.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4704	CATALOGUE2024.GBLTD.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	836	MSBuild.exe
Token: SeDebugPrivilege	4556	powershell.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

CATALOGUE2024.GBLTD.exeMSBuild.execmd.execmd.exe

description	pid	process	target process
PID 4704 wrote to memory of 3180	4704	CATALOGUE2024.GBLTD.exe	powershell.exe
PID 4704 wrote to memory of 3180	4704	CATALOGUE2024.GBLTD.exe	powershell.exe
PID 4704 wrote to memory of 3180	4704	CATALOGUE2024.GBLTD.exe	powershell.exe
PID 4704 wrote to memory of 3088	4704	CATALOGUE2024.GBLTD.exe	schtasks.exe
PID 4704 wrote to memory of 3088	4704	CATALOGUE2024.GBLTD.exe	schtasks.exe
PID 4704 wrote to memory of 3088	4704	CATALOGUE2024.GBLTD.exe	schtasks.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 4704 wrote to memory of 836	4704	CATALOGUE2024.GBLTD.exe	MSBuild.exe
PID 836 wrote to memory of 4020	836	MSBuild.exe	schtasks.exe
PID 836 wrote to memory of 4020	836	MSBuild.exe	schtasks.exe
PID 836 wrote to memory of 4020	836	MSBuild.exe	schtasks.exe
PID 836 wrote to memory of 5100	836	MSBuild.exe	Client.exe
PID 836 wrote to memory of 5100	836	MSBuild.exe	Client.exe
PID 836 wrote to memory of 5100	836	MSBuild.exe	Client.exe
PID 836 wrote to memory of 4556	836	MSBuild.exe	powershell.exe
PID 836 wrote to memory of 4556	836	MSBuild.exe	powershell.exe
PID 836 wrote to memory of 4556	836	MSBuild.exe	powershell.exe
PID 836 wrote to memory of 1344	836	MSBuild.exe	cmd.exe
PID 836 wrote to memory of 1344	836	MSBuild.exe	cmd.exe
PID 836 wrote to memory of 1344	836	MSBuild.exe	cmd.exe
PID 1344 wrote to memory of 4916	1344	cmd.exe	cmd.exe
PID 1344 wrote to memory of 4916	1344	cmd.exe	cmd.exe
PID 1344 wrote to memory of 4916	1344	cmd.exe	cmd.exe
PID 836 wrote to memory of 4876	836	MSBuild.exe	cmd.exe
PID 836 wrote to memory of 4876	836	MSBuild.exe	cmd.exe
PID 836 wrote to memory of 4876	836	MSBuild.exe	cmd.exe
PID 4876 wrote to memory of 1076	4876	cmd.exe	chcp.com
PID 4876 wrote to memory of 1076	4876	cmd.exe	chcp.com
PID 4876 wrote to memory of 1076	4876	cmd.exe	chcp.com
PID 4876 wrote to memory of 2476	4876	cmd.exe	PING.EXE
PID 4876 wrote to memory of 2476	4876	cmd.exe	PING.EXE
PID 4876 wrote to memory of 2476	4876	cmd.exe	PING.EXE
PID 4876 wrote to memory of 1608	4876	cmd.exe	MSBuild.exe
PID 4876 wrote to memory of 1608	4876	cmd.exe	MSBuild.exe
PID 4876 wrote to memory of 1608	4876	cmd.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\CATALOGUE2024.GBLTD.exe
"C:\Users\Admin\AppData\Local\Temp\CATALOGUE2024.GBLTD.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JxgqJBqcy.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3180
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JxgqJBqcy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2159.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Microsoft Corporation" /sc ONLOGON /tr "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4020
- - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k start /b del /q/f/s %TEMP%\* & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K del /q/f/s C:\Users\Admin\AppData\Local\Temp\*
      4⤵
      System Location Discovery: System Language Discovery
      PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vFVppUpQGl4k.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1076
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 10 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2476
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MSBuild.exe.log

Filesize
1KB

MD5
10eab9c2684febb5327b6976f2047587

SHA1
a12ed54146a7f5c4c580416aecb899549712449e

SHA256
f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928

SHA512
7e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
61487be566b2ef97727a176ddfa521b4

SHA1
ee1fa8ee321893f4b51d7b9965a6ec1de11e253e

SHA256
cc0a9821bf049fac24369e950dd24d331f6e5773b6a8f974686c83fbc6dcfa5f

SHA512
799527194edf9ffff195adeac6f9ad1dc4dd5e898d2a340d3792016f14090260ad5e6c883ee046a4cae13f5d6711339d8d79017c3849881a5900006b71ae408c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_adejcyra.1tk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2159.tmp

Filesize
1KB

MD5
5afed88e27d0282f6cab071c9c21aaaa

SHA1
e9504983fb9d4087ed7f3ed1bf4a2ce0de2763c7

SHA256
bdb78e82fd1a9cf27edb9734a568b6e2019e918b73c6b8a27e51c484dc3b1cd2

SHA512
025ad880f0ac2a07e6abcf5779efacbad90b8d9eee5faa5c5bcf7173d2e54298549a05f96934daba16bfce5a4cb4c1dc09ca55d79920dbbefe24919e3c10a142

Download Submit
C:\Users\Admin\AppData\Local\Temp\vFVppUpQGl4k.bat

Filesize
216B

MD5
63ec053800094c81805e61130092ded7

SHA1
8a012d95375c1eeff44538647e14f4ef0aa7d998

SHA256
71f42f8869b66c8c1ce247442ce89655b1be75814c1fd0226ede98f4720e3f26

SHA512
445e85ed823b2da33e171fcee7d8fe41b1f7c28d22214f7d581939426e639aefb020a3b83446c6448e9189d245f188d6504cb0e59141090a970af8f4a4e6eb3d

Download Submit
C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

Filesize
256KB

MD5
8fdf47e0ff70c40ed3a17014aeea4232

SHA1
e6256a0159688f0560b015da4d967f41cbf8c9bd

SHA256
ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

SHA512
bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

Download Submit
memory/836-104-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/836-42-0x0000000006AD0000-0x0000000006B0C000-memory.dmp

Filesize
240KB

Download
memory/836-41-0x0000000006690000-0x00000000066A2000-memory.dmp

Filesize
72KB

Download
memory/836-99-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/836-20-0x0000000000400000-0x000000000048C000-memory.dmp

Filesize
560KB

Download
memory/836-25-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/836-23-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-39-0x00000000062C0000-0x00000000062DE000-memory.dmp

Filesize
120KB

Download
memory/3180-81-0x0000000007920000-0x000000000793A000-memory.dmp

Filesize
104KB

Download
memory/3180-15-0x0000000002990000-0x00000000029C6000-memory.dmp

Filesize
216KB

Download
memory/3180-16-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-17-0x00000000054D0000-0x0000000005AF8000-memory.dmp

Filesize
6.2MB

Download
memory/3180-19-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-95-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-27-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/3180-21-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/3180-28-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Filesize
408KB

Download
memory/3180-26-0x0000000005B30000-0x0000000005B52000-memory.dmp

Filesize
136KB

Download
memory/3180-38-0x0000000005D20000-0x0000000006074000-memory.dmp

Filesize
3.3MB

Download
memory/3180-82-0x0000000007900000-0x0000000007908000-memory.dmp

Filesize
32KB

Download
memory/3180-40-0x0000000006300000-0x000000000634C000-memory.dmp

Filesize
304KB

Download
memory/3180-80-0x0000000007820000-0x0000000007834000-memory.dmp

Filesize
80KB

Download
memory/3180-79-0x0000000007810000-0x000000000781E000-memory.dmp

Filesize
56KB

Download
memory/3180-44-0x0000000006880000-0x00000000068B2000-memory.dmp

Filesize
200KB

Download
memory/3180-55-0x00000000072A0000-0x00000000072BE000-memory.dmp

Filesize
120KB

Download
memory/3180-59-0x00000000072C0000-0x0000000007363000-memory.dmp

Filesize
652KB

Download
memory/3180-78-0x00000000077E0000-0x00000000077F1000-memory.dmp

Filesize
68KB

Download
memory/3180-77-0x0000000007860000-0x00000000078F6000-memory.dmp

Filesize
600KB

Download
memory/3180-76-0x0000000007650000-0x000000000765A000-memory.dmp

Filesize
40KB

Download
memory/3180-65-0x0000000007C20000-0x000000000829A000-memory.dmp

Filesize
6.5MB

Download
memory/3180-45-0x0000000070DD0000-0x0000000070E1C000-memory.dmp

Filesize
304KB

Download
memory/3180-66-0x00000000075E0000-0x00000000075FA000-memory.dmp

Filesize
104KB

Download
memory/4556-83-0x0000000070DD0000-0x0000000070E1C000-memory.dmp

Filesize
304KB

Download
memory/4704-3-0x0000000005880000-0x0000000005912000-memory.dmp

Filesize
584KB

Download
memory/4704-6-0x0000000005B60000-0x0000000005BFC000-memory.dmp

Filesize
624KB

Download
memory/4704-2-0x0000000005E30000-0x00000000063D4000-memory.dmp

Filesize
5.6MB

Download
memory/4704-8-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/4704-5-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/4704-7-0x0000000005A30000-0x0000000005A3E000-memory.dmp

Filesize
56KB

Download
memory/4704-9-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/4704-10-0x0000000006E70000-0x0000000006F3E000-memory.dmp

Filesize
824KB

Download
memory/4704-4-0x0000000005940000-0x000000000594A000-memory.dmp

Filesize
40KB

Download
memory/4704-1-0x0000000000F00000-0x0000000001020000-memory.dmp

Filesize
1.1MB

Download
memory/4704-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/4704-24-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/5100-63-0x0000000005870000-0x00000000059CA000-memory.dmp

Filesize
1.4MB

Download
memory/5100-62-0x00000000056B0000-0x00000000056CA000-memory.dmp

Filesize
104KB

Download
memory/5100-61-0x0000000000EF0000-0x0000000000F30000-memory.dmp

Filesize
256KB

Download