quasar | 497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe
Size

13.3MB
MD5

0d6982311c8a21313994773c99380dfb
SHA1

d8a6abfbdf3fe52598f570abeed3b272b10484bd
SHA256

497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f
SHA512

47b4c7f9a8a49ab067d4214d6cb73277bc56f7e671d3ef3c38ca8d845c65dbf2303e083294d71d68bf4348b87558141d4d3281d959d262efe56b29a87e5437c4
SSDEEP

49152:Kqsm55NYMPrb/T7vO90dL3BmAFd4A64nsfJlFngTR55I7NLz1S:Kq95TUGPf

Score

10^/10

quasar com surrogate discovery evasion spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

COM Surrogate

10.8.1.66:8869

Mutex

119b9028-5664-4725-b2c1-1e4eaf743d68

Attributes

encryption_key
B0092D1E1BA8BCBB825AA0760094E03D6D52E169
install_name
3388.exe
log_directory
COMLogs
reconnect_delay
5000
startup_key
COM Surrogate

Signatures

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/3312-38-0x0000000000420000-0x000000000042C000-memory.dmp	disable_win_def
C:\Users\Admin\AppData\Local\Temp\go-memexec-4143341604.exe	disable_win_def
C:\Windows\temp\cb1ioogv.exe	disable_win_def
behavioral2/memory/2784-47-0x0000000000710000-0x0000000000718000-memory.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

cb1ioogv.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	cb1ioogv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cb1ioogv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cb1ioogv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cb1ioogv.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\go-memexec-822136054.exe	family_quasar
behavioral2/memory/3428-39-0x00000000008D0000-0x0000000000954000-memory.dmp	family_quasar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

go-memexec-1767378521.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	go-memexec-1767378521.exe

Executes dropped EXE 8 IoCs

Processes:

go-memexec-1767378521.exeDISCORD-BUILD.EXEJAVAFIX.EXE-BUILD.EXEWINDEFENDDISABLE.EXE-BUILD.EXEgo-memexec-822136054.exego-memexec-4143341604.execb1ioogv.exe3388.exe

pid	process
2072	go-memexec-1767378521.exe
1960	DISCORD-BUILD.EXE
3304	JAVAFIX.EXE-BUILD.EXE
1304	WINDEFENDDISABLE.EXE-BUILD.EXE
3428	go-memexec-822136054.exe
3312	go-memexec-4143341604.exe
2784	cb1ioogv.exe
1808	3388.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

cb1ioogv.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" cb1ioogv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	cb1ioogv.exe

Drops file in System32 directory 3 IoCs

Processes:

3388.exego-memexec-822136054.exe

description	ioc	process
File opened for modification	C:\Windows\system32\3388.exe	3388.exe
File created	C:\Windows\system32\3388.exe	go-memexec-822136054.exe
File opened for modification	C:\Windows\system32\3388.exe	go-memexec-822136054.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

go-memexec-1767378521.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language go-memexec-1767378521.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2188 taskkill.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

3160 schtasks.exe
3328 schtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	go-memexec-1767378521.exe

pid	process
2188	taskkill.exe

pid	process
3160	schtasks.exe
3328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

go-memexec-4143341604.exe

pid	process
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe
3312	go-memexec-4143341604.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

go-memexec-4143341604.exego-memexec-822136054.exepowershell.exetaskkill.exe3388.exe

description	pid	process
Token: SeDebugPrivilege	3312	go-memexec-4143341604.exe
Token: SeDebugPrivilege	3428	go-memexec-822136054.exe
Token: SeDebugPrivilege	4596	powershell.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	1808	3388.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

go-memexec-4143341604.exe3388.exe

pid process

3312 go-memexec-4143341604.exe
3312 go-memexec-4143341604.exe
1808 3388.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exego-memexec-1767378521.exeJAVAFIX.EXE-BUILD.EXEWINDEFENDDISABLE.EXE-BUILD.EXEgo-memexec-4143341604.execmd.execb1ioogv.exego-memexec-822136054.exe3388.exe

description	pid	process	target process
PID 2384 wrote to memory of 2072	2384	497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe	go-memexec-1767378521.exe
PID 2384 wrote to memory of 2072	2384	497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe	go-memexec-1767378521.exe
PID 2384 wrote to memory of 2072	2384	497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe	go-memexec-1767378521.exe
PID 2072 wrote to memory of 1960	2072	go-memexec-1767378521.exe	DISCORD-BUILD.EXE
PID 2072 wrote to memory of 1960	2072	go-memexec-1767378521.exe	DISCORD-BUILD.EXE
PID 2072 wrote to memory of 3304	2072	go-memexec-1767378521.exe	JAVAFIX.EXE-BUILD.EXE
PID 2072 wrote to memory of 3304	2072	go-memexec-1767378521.exe	JAVAFIX.EXE-BUILD.EXE
PID 2072 wrote to memory of 1304	2072	go-memexec-1767378521.exe	WINDEFENDDISABLE.EXE-BUILD.EXE
PID 2072 wrote to memory of 1304	2072	go-memexec-1767378521.exe	WINDEFENDDISABLE.EXE-BUILD.EXE
PID 3304 wrote to memory of 3428	3304	JAVAFIX.EXE-BUILD.EXE	go-memexec-822136054.exe
PID 3304 wrote to memory of 3428	3304	JAVAFIX.EXE-BUILD.EXE	go-memexec-822136054.exe
PID 1304 wrote to memory of 3312	1304	WINDEFENDDISABLE.EXE-BUILD.EXE	go-memexec-4143341604.exe
PID 1304 wrote to memory of 3312	1304	WINDEFENDDISABLE.EXE-BUILD.EXE	go-memexec-4143341604.exe
PID 3312 wrote to memory of 4008	3312	go-memexec-4143341604.exe	cmstp.exe
PID 3312 wrote to memory of 4008	3312	go-memexec-4143341604.exe	cmstp.exe
PID 1496 wrote to memory of 2784	1496	cmd.exe	cb1ioogv.exe
PID 1496 wrote to memory of 2784	1496	cmd.exe	cb1ioogv.exe
PID 2784 wrote to memory of 4596	2784	cb1ioogv.exe	powershell.exe
PID 2784 wrote to memory of 4596	2784	cb1ioogv.exe	powershell.exe
PID 3428 wrote to memory of 3160	3428	go-memexec-822136054.exe	schtasks.exe
PID 3428 wrote to memory of 3160	3428	go-memexec-822136054.exe	schtasks.exe
PID 3428 wrote to memory of 1808	3428	go-memexec-822136054.exe	3388.exe
PID 3428 wrote to memory of 1808	3428	go-memexec-822136054.exe	3388.exe
PID 1808 wrote to memory of 3328	1808	3388.exe	schtasks.exe
PID 1808 wrote to memory of 3328	1808	3388.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe
"C:\Users\Admin\AppData\Local\Temp\497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\go-memexec-1767378521.exe
  C:\Users\Admin\AppData\Local\Temp\go-memexec-1767378521.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE
    "C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE"
    3⤵
    - Executes dropped EXE
    PID:1960
- - C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE
    "C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-822136054.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-822136054.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\go-memexec-822136054.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3160
    - - C:\Windows\system32\3388.exe
        
        "C:\Windows\system32\3388.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1808
      - C:\Windows\system32\schtasks.exe
        
        "schtasks" /create /tn "COM Surrogate" /sc ONLOGON /tr "C:\Windows\system32\3388.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3328
- - C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE
    "C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\go-memexec-4143341604.exe
      C:\Users\Admin\AppData\Local\Temp\go-memexec-4143341604.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3312
    - - \??\c:\windows\system32\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\o4muholf.inf
        5⤵
        
        PID:4008

C:\Windows\system32\cmd.exe
cmd /c start C:\Windows\temp\cb1ioogv.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\temp\cb1ioogv.exe
  C:\Windows\temp\cb1ioogv.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Get-MpPreference -verbose
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4596

C:\Windows\system32\taskkill.exe
taskkill /IM cmstp.exe /F
1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DISCORD-BUILD.EXE

Filesize
1.6MB

MD5
f50a77623d245a4599777ab4fbf714c6

SHA1
ef50b96df7cd351b62bdca83b7244e550d4a2e89

SHA256
0f68faff74b9185ca8c48dd2aa5bfdf0ee5dcf0c7a0282e964b4d29d807143cf

SHA512
1b8c09465a6cb42a5b121187edbb1082edcd8f5983d61cb243514ef8da4f90a64f7d0d6f9a08b346a869a065f981ab469cc6f97c6edffd5be79f281b180094b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\JAVAFIX.EXE-BUILD.EXE

Filesize
2.6MB

MD5
6f5376f20c7f474f5554222d01456849

SHA1
4931b9dc0767c76dc31e3e6c4423a961c0f51d86

SHA256
bdbc5164ef806974456f579200541d7c84f643377c86b0bc3c1081ddd1317146

SHA512
3c0510afbd1b076889491f7e177e03cd7e73b1debd1c416765bf18890e916a504376af7b04923ee233d78e08124f0d89fc60ca4dcc256ca44adffa87b83a59e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WINDEFENDDISABLE.EXE-BUILD.EXE

Filesize
1.6MB

MD5
9af255f8c616c0cce55ba6ebed9575cd

SHA1
06e0a3e0183c0dada31c3e7f2195f2156f98f336

SHA256
83a53512f6ed96e88941330b73ceffed794603da3204d169eb44826b0a03985f

SHA512
05e0c2d059de60ff0186b372198148f3980738e71328366b585045477ef9e3f62ad230fbcbee3c4aac9113f178d77cf2745c0a17205867a12e6dda5766bf14f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xajenh21.krr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\go-memexec-1767378521.exe

Filesize
5.8MB

MD5
456fda268601e84c3308378d26dc74d2

SHA1
a27d3718b6338927e98a38219862f5859528d5fb

SHA256
b9a1d3ee098339ac5942b437f76cb25bf5f33dacb65a883162a447c158702cfb

SHA512
a70ab8ffa8f429aa9e98eb181d405ad01333258b4646d67ec3b9743267e56de11cac9eff2a41611e7a3e269f8577a8db6217341f1ca68bdaedafbdd0e7699434

Download Submit
C:\Users\Admin\AppData\Local\Temp\go-memexec-4143341604.exe

Filesize
19KB

MD5
c6e7fd0dc447c35e6e31aad46e83de96

SHA1
5367e124d66f45babf625b56418155ea5a04ccd3

SHA256
60a855b888b3021d74803be43ae95ec62ec509ed3d70dd734295d12d9375a0a1

SHA512
6c7a43aa7dd335e388db6cb651ab1bfd4e3d3abb82b31dce2900178af27616e330e84d8e5d89a3435eb8939cfed0a23892f3aeac219c883f4e53a51932d61746

Download Submit
C:\Users\Admin\AppData\Local\Temp\go-memexec-822136054.exe

Filesize
502KB

MD5
e49e8745bb3748c02b6991155ef988f9

SHA1
13ce804a8d4dd951b5535ceb819be3f04372f375

SHA256
9e105120064cd753917b8f60a20dedc1d5c33156189afdcc514189b07d23587e

SHA512
f7b514a905ba52970f5c17bd91e12a07ebd3e3715d3b5c59284c8f09ea7e4da317fd3968a46b164e520757de9567bd0ef36f0b0bed79e7aacd412032322a416d

Download Submit
C:\Windows\temp\cb1ioogv.exe

Filesize
12KB

MD5
9cfc5141261e2144858e32a779e4e87f

SHA1
5698cb6c917d92a40d44f6e096acbf90be3a86c5

SHA256
e117d0ef5ed73d676fb845556b2ca33fe68c1728069ad1df39429b2ad5feaa15

SHA512
340af9ef8bad9678ef458e2e57aa79d5038fe1805e8a7a67e5a839efd89f6aa414d0022d233d624317eff1ca225f1b7a3b8637f0555511fddc588a9aeab34003

Download Submit
C:\Windows\temp\o4muholf.inf

Filesize
606B

MD5
9af3c8c66c03febc6ebf639a91b596b7

SHA1
b3c24ef18328c9166a9771064847a69db34ba8fb

SHA256
1370e0b0d3125e1c8bbaa4890baafae9c22573ecc4d827d6751be22c21108d64

SHA512
46a4550ea227d4f43d7355b3deefeb2087dac63e39f205b818abebe4f825b9ab20f45df053f98b253e5ad6f3911e19afb4d368d5ea11f7e5d44654f090c31401

Download Submit
memory/1808-68-0x000000001B700000-0x000000001B750000-memory.dmp

Filesize
320KB

Download
memory/1808-69-0x000000001BF90000-0x000000001C042000-memory.dmp

Filesize
712KB

Download
memory/2784-47-0x0000000000710000-0x0000000000718000-memory.dmp

Filesize
32KB

Download
memory/3312-38-0x0000000000420000-0x000000000042C000-memory.dmp

Filesize
48KB

Download
memory/3428-39-0x00000000008D0000-0x0000000000954000-memory.dmp

Filesize
528KB

Download
memory/3428-37-0x00007FFF96933000-0x00007FFF96935000-memory.dmp

Filesize
8KB

Download
memory/4596-58-0x0000015BC4010000-0x0000015BC4032000-memory.dmp

Filesize
136KB

Download