quasar | 6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411

Resubmissions

21-01-2025 15:41

250121-s4qhga1pak 10

21-01-2025 15:31

250121-sygy5szrcy 10

Analysis

max time kernel
62s
max time network
63s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21-01-2025 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

emmasBackdoor.exe
Size

2.9MB
MD5

0266f80fe6efd3e3e4bd0363d17bcbde
SHA1

b144914eb53d2e35e410be64d2db052d06d680df
SHA256

6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411
SHA512

21174624b988b26d16ba96c57b65a0dd0c0fa02d5396ca29c5cc11851f7546a528e1343f3216b224f3deebb1e749ac1dfd02fc5485bf4a0dd5b6d0983c496ac8
SSDEEP

49152:EwREDDMVBq77B4L8lXQn/zJNGJ7YTpZIn+lD2GgWinoaDFO/82:EwRE8q77B44+zJNN1aHNo2O/82

Score

10^/10

quasar emmassub discovery evasion execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

EmmasSub

rath3r.xyz:4782

Mutex

7126373e-e872-4f94-bbbb-42e88d57137b

Attributes

encryption_key
4DC093FC202D016F95DCEE92AAF2874F56ACC3F2
install_name
Windows.WARP.JITService.exe
log_directory
Logs
reconnect_delay
3000
startup_key
MicrosoftUpdateTaskMachineCore
subdirectory
ice

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	powershell.exe

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002aba5-71.dat	family_quasar
behavioral1/memory/536-73-0x0000000000B60000-0x0000000000E84000-memory.dmp	family_quasar

Executes dropped EXE 4 IoCs

pid	Process
3928	emmasBackdoor.tmp
536	Client.exe
572	Windows.WARP.JITService.exe
3536	Client.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\ice\Windows.WARP.JITService.exe	Client.exe
File opened for modification	C:\Windows\system32\ice\Windows.WARP.JITService.exe	Client.exe
File opened for modification	C:\Windows\system32\ice	Client.exe
File opened for modification	C:\Windows\system32\ice\Windows.WARP.JITService.exe	Windows.WARP.JITService.exe
File opened for modification	C:\Windows\system32\ice	Windows.WARP.JITService.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EmmasBackdoor\is-AMTN8.tmp	emmasBackdoor.tmp
File created	C:\Program Files (x86)\EmmasBackdoor\is-H7KOU.tmp	emmasBackdoor.tmp
File opened for modification	C:\Program Files (x86)\EmmasBackdoor\unins000.dat	emmasBackdoor.tmp
File opened for modification	C:\Program Files (x86)\EmmasBackdoor\Client.exe	emmasBackdoor.tmp
File created	C:\Program Files (x86)\EmmasBackdoor\unins000.dat	emmasBackdoor.tmp

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1324	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emmasBackdoor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	emmasBackdoor.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\EmmasBackdoorFile.myp\shell\open\command	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Client.exe	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Client.exe\SupportedTypes	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\.myp\OpenWithProgids	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\EmmasBackdoorFile.myp	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell\open\command	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell\open\command\ = "\"C:\\Program Files (x86)\\EmmasBackdoor\\Client.exe\" \"%1\""	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\Client.exe\SupportedTypes\.myp	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\ = "EmmasBackdoor File"	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\DefaultIcon\ = "C:\\Program Files (x86)\\EmmasBackdoor\\Client.exe,0"	emmasBackdoor.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids\EmmasBackdoorFile.myp	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\Client.exe\SupportedTypes	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\Software\Classes\EmmasBackdoorFile.myp\DefaultIcon	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp	emmasBackdoor.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EmmasBackdoorFile.myp\shell\open	emmasBackdoor.tmp

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2380	schtasks.exe
3220	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1324	powershell.exe
1324	powershell.exe
3928	emmasBackdoor.tmp
3928	emmasBackdoor.tmp
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3696	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	536	Client.exe
Token: SeDebugPrivilege	572	Windows.WARP.JITService.exe
Token: SeDebugPrivilege	3696	taskmgr.exe
Token: SeSystemProfilePrivilege	3696	taskmgr.exe
Token: SeCreateGlobalPrivilege	3696	taskmgr.exe
Token: SeDebugPrivilege	3536	Client.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3928	emmasBackdoor.tmp
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe

Suspicious use of SendNotifyMessage 49 IoCs

pid	Process
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe
3696	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
572	Windows.WARP.JITService.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 3928	1956	emmasBackdoor.exe	78
PID 1956 wrote to memory of 3928	1956	emmasBackdoor.exe	78
PID 1956 wrote to memory of 3928	1956	emmasBackdoor.exe	78
PID 3928 wrote to memory of 1324	3928	emmasBackdoor.tmp	79
PID 3928 wrote to memory of 1324	3928	emmasBackdoor.tmp	79
PID 3928 wrote to memory of 1324	3928	emmasBackdoor.tmp	79
PID 3928 wrote to memory of 536	3928	emmasBackdoor.tmp	82
PID 3928 wrote to memory of 536	3928	emmasBackdoor.tmp	82
PID 536 wrote to memory of 2380	536	Client.exe	83
PID 536 wrote to memory of 2380	536	Client.exe	83
PID 536 wrote to memory of 572	536	Client.exe	85
PID 536 wrote to memory of 572	536	Client.exe	85
PID 572 wrote to memory of 3220	572	Windows.WARP.JITService.exe	86
PID 572 wrote to memory of 3220	572	Windows.WARP.JITService.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe
"C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Users\Admin\AppData\Local\Temp\is-2MGJ8.tmp\emmasBackdoor.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2MGJ8.tmp\emmasBackdoor.tmp" /SL5="$50102,1909968,965632,C:\Users\Admin\AppData\Local\Temp\emmasBackdoor.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\is-83R7C.tmp\disable_defender.ps1"
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- - C:\Program Files (x86)\EmmasBackdoor\Client.exe
    "C:\Program Files (x86)\EmmasBackdoor\Client.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "MicrosoftUpdateTaskMachineCore" /sc ONLOGON /tr "C:\Windows\system32\ice\Windows.WARP.JITService.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2380
  - - C:\Windows\system32\ice\Windows.WARP.JITService.exe
      "C:\Windows\system32\ice\Windows.WARP.JITService.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "MicrosoftUpdateTaskMachineCore" /sc ONLOGON /tr "C:\Windows\system32\ice\Windows.WARP.JITService.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3644

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3696

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3372

C:\Program Files (x86)\EmmasBackdoor\Client.exe
"C:\Program Files (x86)\EmmasBackdoor\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\EmmasBackdoor\Client.exe

Filesize
3.1MB

MD5
66ebe604ddf4d6ab60a183f515536528

SHA1
278782873ae0a5cac94add051edfc12e223be55c

SHA256
37e733731381c02941e4a8da30350cf968532d08012b6bb91e525241e8ee2c86

SHA512
756de51b5f6116640736f7dd37faf6172db79c8eaf8da17ba1e3d788d5c0179a01746f7d30044ca5c535c1b3d938bfde3e5d810b7fe50815030be8a5288c2bf9

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EmmasBackdoor.lnk

Filesize
1KB

MD5
3188d6b66851379af27201e187e55ca4

SHA1
f06e592dd26b71818fd3410f086acc0b5c748729

SHA256
09da50da70ac60e012eb4db1ee578f49e3e9412307c302ec6fb762eeed388725

SHA512
138ca9c1e10fb9fbb8521013975f3bc2e86ce1a3d882c9f5aa30660a3f4ceaef96a4657257b9e56279f3a358126a6eea3fa831d9f84548ebadd2cb4eb30b2a2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
1KB

MD5
b4e91d2e5f40d5e2586a86cf3bb4df24

SHA1
31920b3a41aa4400d4a0230a7622848789b38672

SHA256
5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210

SHA512
968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yrm2yydj.cse.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2MGJ8.tmp\emmasBackdoor.tmp

Filesize
3.3MB

MD5
95c49a50069cf27284ac7b186df5aae0

SHA1
4120193848e7726aac277f9ea6e4b3670342ed03

SHA256
9f62b6f4c234ded050162b55a9c6de0c604578dee34462b96615e48169a485bb

SHA512
f6d3fd7454943aac838cd81e17c35787747185e0736823424453ffbf375da1e921dba0a5ce88a05f7a71e2ac367d47ee8fbabbd529f48997b99f1a3afa5370cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-83R7C.tmp\disable_defender.ps1

Filesize
544B

MD5
3568227fbb730d48fa31d13e87f9a370

SHA1
83ac8fbb2b9c35337f372977fe3323f63060c5ff

SHA256
a06e1c77a4ab2a13f90dc2f86bbb4cb662f2bd10b1f805b1b7745af4c2ad3698

SHA512
2b8863dbdc4c980eac867e600ca008261d046a99bf40cfc02a350ec45a04e3a7b958b21219ad0a26b339336f779ba167aa84c45dbe4d9d9ada004c4515ba6d17

Download Submit
memory/536-73-0x0000000000B60000-0x0000000000E84000-memory.dmp

Filesize
3.1MB

Download
memory/572-98-0x000000001CE80000-0x000000001D3A8000-memory.dmp

Filesize
5.2MB

Download
memory/572-84-0x000000001C540000-0x000000001C5F2000-memory.dmp

Filesize
712KB

Download
memory/572-83-0x000000001BB10000-0x000000001BB60000-memory.dmp

Filesize
320KB

Download
memory/1324-48-0x00000000077F0000-0x0000000007801000-memory.dmp

Filesize
68KB

Download
memory/1324-53-0x0000000007970000-0x0000000007992000-memory.dmp

Filesize
136KB

Download
memory/1324-16-0x0000000005C20000-0x0000000005C86000-memory.dmp

Filesize
408KB

Download
memory/1324-25-0x0000000005D70000-0x00000000060C7000-memory.dmp

Filesize
3.3MB

Download
memory/1324-26-0x0000000006280000-0x000000000629E000-memory.dmp

Filesize
120KB

Download
memory/1324-27-0x00000000062C0000-0x000000000630C000-memory.dmp

Filesize
304KB

Download
memory/1324-14-0x00000000053E0000-0x0000000005402000-memory.dmp

Filesize
136KB

Download
memory/1324-30-0x00000000701F0000-0x000000007023C000-memory.dmp

Filesize
304KB

Download
memory/1324-29-0x0000000007280000-0x00000000072B4000-memory.dmp

Filesize
208KB

Download
memory/1324-39-0x0000000006880000-0x000000000689E000-memory.dmp

Filesize
120KB

Download
memory/1324-40-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/1324-41-0x00000000072C0000-0x0000000007364000-memory.dmp

Filesize
656KB

Download
memory/1324-42-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/1324-44-0x0000000007C80000-0x00000000082FA000-memory.dmp

Filesize
6.5MB

Download
memory/1324-45-0x0000000007600000-0x000000000761A000-memory.dmp

Filesize
104KB

Download
memory/1324-43-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/1324-46-0x0000000007650000-0x000000000765A000-memory.dmp

Filesize
40KB

Download
memory/1324-47-0x0000000007880000-0x0000000007916000-memory.dmp

Filesize
600KB

Download
memory/1324-9-0x0000000073FEE000-0x0000000073FEF000-memory.dmp

Filesize
4KB

Download
memory/1324-49-0x0000000007830000-0x000000000783E000-memory.dmp

Filesize
56KB

Download
memory/1324-50-0x0000000007840000-0x0000000007855000-memory.dmp

Filesize
84KB

Download
memory/1324-51-0x0000000007920000-0x000000000793A000-memory.dmp

Filesize
104KB

Download
memory/1324-52-0x0000000007940000-0x0000000007948000-memory.dmp

Filesize
32KB

Download
memory/1324-15-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/1324-54-0x00000000088B0000-0x0000000008E56000-memory.dmp

Filesize
5.6MB

Download
memory/1324-57-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/1324-10-0x0000000004DF0000-0x0000000004E26000-memory.dmp

Filesize
216KB

Download
memory/1324-11-0x0000000005510000-0x0000000005B3A000-memory.dmp

Filesize
6.2MB

Download
memory/1324-12-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/1324-13-0x0000000073FE0000-0x0000000074791000-memory.dmp

Filesize
7.7MB

Download
memory/1956-0-0x0000000000580000-0x000000000067A000-memory.dmp

Filesize
1000KB

Download
memory/1956-2-0x0000000000581000-0x0000000000629000-memory.dmp

Filesize
672KB

Download
memory/1956-76-0x0000000000580000-0x000000000067A000-memory.dmp

Filesize
1000KB

Download
memory/1956-68-0x0000000000580000-0x000000000067A000-memory.dmp

Filesize
1000KB

Download
memory/3696-92-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-93-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-87-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-86-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-91-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-96-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-94-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-85-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-95-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3696-97-0x00000200B12D0000-0x00000200B12D1000-memory.dmp

Filesize
4KB

Download
memory/3928-69-0x0000000000C50000-0x0000000000FA9000-memory.dmp

Filesize
3.3MB

Download
memory/3928-58-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/3928-6-0x0000000003250000-0x0000000003251000-memory.dmp

Filesize
4KB

Download
memory/3928-75-0x0000000000C50000-0x0000000000FA9000-memory.dmp

Filesize
3.3MB

Download