quasar | 6661ba1349745231bcee0d0f97ad80ed2db94732ab32cb4fa5e969cfa631a695

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built1.exe
Size

3.1MB
MD5

bcaf70faf8cef879f13519ff4a94f9ab
SHA1

cdc11c7fd22cacf568ccdd97d00928128e35e974
SHA256

6661ba1349745231bcee0d0f97ad80ed2db94732ab32cb4fa5e969cfa631a695
SHA512

f0d795820773834b6fb19ba92cb0a698e645498f1252594626d88cdf952bc4503d4e4d32f970bad0267b7040af898721e186215184a27ca6a9aa05f829b77214
SSDEEP

49152:nv7I22SsaNYfdPBldt698dBcjHrKJGKGCDiUTHHB72eh2NT:nvE22SsaNYfdPBldt6+dBcjHrKQ

Score

10^/10

quasar system discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

SYSTEM

rather-reputation.gl.at.ply.gg:23827

Mutex

6f4b08b2-7091-41aa-a67e-9b869448a0c0

Attributes

encryption_key
17D2A006DF537BB025A18049E5586744E13D89C5
install_name
trey.exe
log_directory
Logs
reconnect_delay
3000
startup_key
SYSTEM
subdirectory
trey

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/memory/2352-1-0x0000000000940000-0x0000000000C64000-memory.dmp	family_quasar
behavioral2/files/0x000a000000023b75-7.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
1588	trey.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1844	schtasks.exe
1076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3880	msedge.exe
3880	msedge.exe
2324	msedge.exe
2324	msedge.exe
3588	identity_helper.exe
3588	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	Client-built1.exe
Token: SeDebugPrivilege	1588	trey.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
1588	trey.exe
1588	trey.exe
1588	trey.exe
1588	trey.exe
1588	trey.exe
1588	trey.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1588	trey.exe
1588	trey.exe
1588	trey.exe
1588	trey.exe
1588	trey.exe
1588	trey.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	trey.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1076	2352	Client-built1.exe	83
PID 2352 wrote to memory of 1076	2352	Client-built1.exe	83
PID 2352 wrote to memory of 1588	2352	Client-built1.exe	85
PID 2352 wrote to memory of 1588	2352	Client-built1.exe	85
PID 1588 wrote to memory of 1844	1588	trey.exe	86
PID 1588 wrote to memory of 1844	1588	trey.exe	86
PID 2324 wrote to memory of 116	2324	msedge.exe	111
PID 2324 wrote to memory of 116	2324	msedge.exe	111
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 1904	2324	msedge.exe	112
PID 2324 wrote to memory of 3880	2324	msedge.exe	113
PID 2324 wrote to memory of 3880	2324	msedge.exe	113
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114
PID 2324 wrote to memory of 1696	2324	msedge.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built1.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built1.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "SYSTEM" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\trey\trey.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1076
- C:\Users\Admin\AppData\Roaming\trey\trey.exe
  "C:\Users\Admin\AppData\Roaming\trey\trey.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "SYSTEM" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\trey\trey.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc5ca846f8,0x7ffc5ca84708,0x7ffc5ca84718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1976,10831141829727141851,4746697487369269143,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2a14b223e75d60d3b5259549037ea65d

SHA1
26a506c3253633fe8ee1285243a6fa72a6976bbc

SHA256
85ba16a0692e49657695e6fb4e18af639a2e9a5edbb89cb4bdb4771788e97fe5

SHA512
aff1bb5c9c8bbbdd9a4a35894d608476f92876734eeb012675aad9b752580bfa8adfaeed8e4523ab76b0b36715236afed0d6e105ea87ee74928464d5c74e6d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f1fab2168de20a0e6035f002e6a02a5

SHA1
79965aaf4c481f599ebc598281e11df156eba02b

SHA256
c85f9726b0ef25e4258f68684b6a3c4d7397b23867a1d8a3372910ea835ef38a

SHA512
f71710085a43de5517e5716f3222e77dca4c53bc7eaf2d2523a8986ccd736b5fe3ea1fe7aee640e3770d0e20b8b5beeef9187cb7b34f775153905f114b88b446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
19da0a903ca14ad39df11df6245df48d

SHA1
dbfc65ee9753bf6c20b79ac29e3ed56d8be8be9b

SHA256
88715be79a041c3f35a075036b3a731cdb284178d9d50db56ae912eb3219ae00

SHA512
8867a1a93221f9c50b993378469aee640a8d004c21ae8451af26ff6f2e4fb6b4e454094b98880c3c80893fc19a428b5a5a1f782ad53dbdc1744e50a87dc926ec

Download Submit
C:\Users\Admin\AppData\Roaming\trey\trey.exe

Filesize
3.1MB

MD5
bcaf70faf8cef879f13519ff4a94f9ab

SHA1
cdc11c7fd22cacf568ccdd97d00928128e35e974

SHA256
6661ba1349745231bcee0d0f97ad80ed2db94732ab32cb4fa5e969cfa631a695

SHA512
f0d795820773834b6fb19ba92cb0a698e645498f1252594626d88cdf952bc4503d4e4d32f970bad0267b7040af898721e186215184a27ca6a9aa05f829b77214

Download Submit
memory/1588-12-0x000000001BE70000-0x000000001BEC0000-memory.dmp

Filesize
320KB

Download
memory/1588-28-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-16-0x000000001BF00000-0x000000001BF12000-memory.dmp

Filesize
72KB

Download
memory/1588-17-0x000000001CB80000-0x000000001CBBC000-memory.dmp

Filesize
240KB

Download
memory/1588-18-0x00007FFC61BE0000-0x00007FFC626A1000-memory.dmp

Filesize
10.8MB

Download
memory/1588-19-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-20-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-21-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-22-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-26-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-27-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-13-0x000000001BF80000-0x000000001C032000-memory.dmp

Filesize
712KB

Download
memory/1588-98-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-9-0x00007FFC61BE0000-0x00007FFC626A1000-memory.dmp

Filesize
10.8MB

Download
memory/1588-11-0x00007FFC61BE0000-0x00007FFC626A1000-memory.dmp

Filesize
10.8MB

Download
memory/1588-59-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/1588-88-0x000000001CFC0000-0x000000001D169000-memory.dmp

Filesize
1.7MB

Download
memory/2352-2-0x00007FFC61BE0000-0x00007FFC626A1000-memory.dmp

Filesize
10.8MB

Download
memory/2352-1-0x0000000000940000-0x0000000000C64000-memory.dmp

Filesize
3.1MB

Download
memory/2352-10-0x00007FFC61BE0000-0x00007FFC626A1000-memory.dmp

Filesize
10.8MB

Download
memory/2352-0-0x00007FFC61BE3000-0x00007FFC61BE5000-memory.dmp

Filesize
8KB

Download