quasar | ad70830f714dab841058a342f6e1d1838664a123bb9ee06c9e224d26389f59a6

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pass is Thunk - Onimai 1.7.1.rar
Size

11.4MB
MD5

39a00cb903601cdcc7e8560980c12ebc
SHA1

79ed82c7e958de613c395592ffe4849a87ca84f6
SHA256

ad70830f714dab841058a342f6e1d1838664a123bb9ee06c9e224d26389f59a6
SHA512

9640854ad4c47555f83cdb7b9f8c60135e8693a31663ccfd9bb084334ebe00747027a581c0a81dd760a2302ab71465770ba2e0cee2d559c1262a1b8bfe91547d
SSDEEP

196608:81ScDBvuzZoV0fgpErKMCFExitZ0uK+OpKfbnxK208bzDNEKsA:MtmzKV0fgpvyx6ZH8QNKabzP

Score

10^/10

quasar stormkitty xworm discovery persistence rat spyware stealer trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Extracted

Family

xworm

Version

5.0

Mutex

867aeGIEEecFXBcr

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/Hicz3DVN

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024295-194.dat	family_xworm
behavioral1/memory/4460-204-0x00000000005D0000-0x00000000005DE000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024210-114.dat	family_quasar
behavioral1/memory/4844-117-0x0000000000C00000-0x0000000000CA6000-memory.dmp	family_quasar
behavioral1/files/0x000700000002428a-172.dat	family_quasar
behavioral1/memory/4352-203-0x00000206CFFC0000-0x00000206CFFD8000-memory.dmp	family_quasar
behavioral1/files/0x000700000002428f-201.dat	family_quasar
behavioral1/memory/4352-187-0x00000206CF890000-0x00000206CFBCA000-memory.dmp	family_quasar

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/4460-236-0x000000001C880000-0x000000001C9A0000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	Onimai 1.7.1.exe

Executes dropped EXE 5 IoCs

pid	Process
4844	Client.exe
4180	Onimai 1.7.1.exe
4352	Onimai Cracked by MaximsRu.exe
4460	fontdrvhost.exe
5904	fontdrvhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fontdrvhost.exe"	Onimai 1.7.1.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
60	pastebin.com
61	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Onimai Cracked by MaximsRu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Onimai Cracked by MaximsRu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Onimai Cracked by MaximsRu.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2204	7zFM.exe
4352	Onimai Cracked by MaximsRu.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	2204	7zFM.exe
Token: 35	2204	7zFM.exe
Token: SeSecurityPrivilege	2204	7zFM.exe
Token: SeDebugPrivilege	4844	Client.exe
Token: SeDebugPrivilege	4352	Onimai Cracked by MaximsRu.exe
Token: SeDebugPrivilege	4460	fontdrvhost.exe
Token: SeDebugPrivilege	5904	fontdrvhost.exe
Token: SeDebugPrivilege	4844	taskmgr.exe
Token: SeSystemProfilePrivilege	4844	taskmgr.exe
Token: SeCreateGlobalPrivilege	4844	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2204	7zFM.exe
2204	7zFM.exe
4352	Onimai Cracked by MaximsRu.exe
4352	Onimai Cracked by MaximsRu.exe
4352	Onimai Cracked by MaximsRu.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4352	Onimai Cracked by MaximsRu.exe
4352	Onimai Cracked by MaximsRu.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe
4844	taskmgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 4352	4180	Onimai 1.7.1.exe	107
PID 4180 wrote to memory of 4352	4180	Onimai 1.7.1.exe	107
PID 4180 wrote to memory of 4460	4180	Onimai 1.7.1.exe	110
PID 4180 wrote to memory of 4460	4180	Onimai 1.7.1.exe	110
PID 3064 wrote to memory of 5904	3064	cmd.exe	111
PID 3064 wrote to memory of 5904	3064	cmd.exe	111

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Pass is Thunk - Onimai 1.7.1.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2204

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2852

C:\Users\Admin\Desktop\Onimai 1.7.1\Client.exe
"C:\Users\Admin\Desktop\Onimai 1.7.1\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4844

C:\Users\Admin\Desktop\Onimai 1.7.1\Onimai 1.7.1.exe
"C:\Users\Admin\Desktop\Onimai 1.7.1\Onimai 1.7.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Users\Admin\AppData\Local\Temp\Onimai Cracked by MaximsRu.exe
  "C:\Users\Admin\AppData\Local\Temp\Onimai Cracked by MaximsRu.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
  "C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
  C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5904

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Guna.UI2.dll

Filesize
2.1MB

MD5
b464fc896b14bfa34f608da53856e999

SHA1
55568eecc97895cad49a42bffe757e3588c5313c

SHA256
2130c7489f5a5e21812c1eab37dc4903b901861a2d545aa607555be269091afd

SHA512
1b310b16b0973c9100c9d220338ffc9340b4085d7a095cc601998b5cbcb67b927d8665070bd8b6e2af2a29d13762f404a794b79dbe223b48751894a4bf47c5ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Onimai Cracked by MaximsRu.exe

Filesize
3.2MB

MD5
6d64de1b4000e0f99ab18603eefd377f

SHA1
727fde2765a03e150df932134a054e826e971d90

SHA256
21871f410393d8711d8cd470fdb15362d7f625885844abe5fe7a83fea4702e0f

SHA512
fd990b6886e8b6e4adb5d3328582bb4d9c5253bf5d612fb3e6f3919eae7b7772789148b5bad2c8c1bc54c239e6117910ba50be63100b1f17aa337937f012a7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Open.Nat.dll

Filesize
68KB

MD5
cc6f6503d29a99f37b73bfd881de8ae0

SHA1
92d3334898dbb718408f1f134fe2914ef666ce46

SHA256
0b1e0d8f87f557b52315d98c1f4727e539f5120d20b4ca9edba548983213fbb5

SHA512
7f4c0a35b612b864ad9bc6a46370801ed7433424791622bf77bf47d6a776cb6a49e4977b34725ead5d0feaa1c9516db2ca75cb8872c77a8f2fab6c37740b681f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Quasar.Common.dll

Filesize
72KB

MD5
5f151fafb1d7bbfee64ff52ca2222772

SHA1
1d27cfa608b501d498e57f286f4e15b34861a679

SHA256
d7a74254b48ed75c1457c6c6158cc9bbe367d741bd5da4d46a118724662b583f

SHA512
564df0035d0a3162c950d8fb9ee6eba40b6ac8a7269816958a22e32bce2a3ef891c7d428348c03f9fae8ba1060b73668c3d9f10f39777aa71f51748b374e3305

Download Submit
C:\Users\Admin\AppData\Local\Temp\fontdrvhost.exe

Filesize
32KB

MD5
cdf00ce54c37487b8e3751a4a31e8fee

SHA1
48ce7b5fe1fcf6373a8ce397f175410c5df952cc

SHA256
b460ee743b35bd8ab997d9039d218392d8dce68bfa64c2126aa1969b81b0a67e

SHA512
bab8555dcb9e92199f4221b194beeb16d6b6832c821c0a3ddc0484b2a9d0443fc6cb9d3d9e9a6ae997503ef0cc948af777a835e0b9c019a10de4abb5e2ff7780

Download Submit
C:\Users\Admin\AppData\Local\Temp\protobuf-net.dll

Filesize
284KB

MD5
1c2c6b341535661b7501f5c4a434a78e

SHA1
f45aefa816f86830bee41c0e5426e641d5af3c06

SHA256
9429f05aa4ab1ef92a0237410ea103cffa406b071953d50f5e7a55496d517c02

SHA512
14b8653b04865a8efeda23149cd624cbe0ebd6e676a7f9cb4ba994a129cba975b9eb928de0f396eb3a37449469549ede36ec2ceec7e61d68773fd72c422fef8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\quasar.p12

Filesize
4KB

MD5
1426ce52345553dd316aea4c38627186

SHA1
72a0c8057e5b11fada265623d8538f411f43e379

SHA256
3b779cc175ad0272cf48bd5e69c9f4b77f7100d0c48244357fe6fef271b19dfc

SHA512
264727f006530f34d1b3014a2d0190b62cfa8e7eaf6e833bace776545ed971fa03691376f309fa97e5fdfb5f9c1f838c34237a82de47a2a1a16054c01419fc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\settings.xml

Filesize
452B

MD5
eac9d2683784056dbcb1ebe03a985b50

SHA1
b481c43b74f0821efb45f3cf81291df1f5342177

SHA256
b4141e054815d98176c90c599c0a6e12e684eb6a9624fe90141e044f55cc94c9

SHA512
6c644a3627486881dd25201c0722495a52fd3eb2c8d8cf990d3735893e864b34f98ec53da43b4ba0488c4b93d79706c6b90b119beb374dc81644ba2b2ac07f25

Download Submit
C:\Users\Admin\Desktop\Onimai 1.7.1\Client.exe

Filesize
637KB

MD5
2d3b17e3a7dd2febc7fa9a011355fbd8

SHA1
7bc605ec4ef0ee3d78e08dfe30b91c60e5563731

SHA256
d24a538a3e127a55e92735dde553a9cf44da42f7f6a9ba59d267a88b13fd85de

SHA512
b559eed8a0e7eeb9ae635ee06e20c8b99ec8ce90a5005f5474833ce5d4ee134d9e150e09178f47f827e15a2680b5082ad6b3a84ca41d3389d9ab8d62be176025

Download Submit
C:\Users\Admin\Desktop\Onimai 1.7.1\Onimai 1.7.1.exe

Filesize
7.9MB

MD5
8ea54a686d9f786351c7847d4b72e9f5

SHA1
a8873506b638d567ff54e068ac312e3f081ab0cd

SHA256
4e90fa3f4197c83ee858b522e2a99a8145da5e0f972f06a9b825e4a2781dc550

SHA512
70253ab77ebced40018e1577981f0fcfd721e0cc246c1eed43f344d11ef407319d58d2a349b3a4f614e75409e7c5d1fa60792a95fc64b5dc54a6edb919e4e9e0

Download Submit
memory/4180-122-0x0000000000980000-0x0000000001176000-memory.dmp

Filesize
8.0MB

Download
memory/4352-216-0x00000206ED840000-0x00000206EDD0C000-memory.dmp

Filesize
4.8MB

Download
memory/4352-214-0x00000206ED1A0000-0x00000206ED1F0000-memory.dmp

Filesize
320KB

Download
memory/4352-206-0x00000206EA4C0000-0x00000206EA6DC000-memory.dmp

Filesize
2.1MB

Download
memory/4352-187-0x00000206CF890000-0x00000206CFBCA000-memory.dmp

Filesize
3.2MB

Download
memory/4352-203-0x00000206CFFC0000-0x00000206CFFD8000-memory.dmp

Filesize
96KB

Download
memory/4352-218-0x00000206ED1F0000-0x00000206ED23E000-memory.dmp

Filesize
312KB

Download
memory/4352-213-0x00000206ECF30000-0x00000206ECF48000-memory.dmp

Filesize
96KB

Download
memory/4352-215-0x00000206ED2B0000-0x00000206ED362000-memory.dmp

Filesize
712KB

Download
memory/4460-204-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download
memory/4460-273-0x000000001C720000-0x000000001C742000-memory.dmp

Filesize
136KB

Download
memory/4460-237-0x0000000002910000-0x000000000291E000-memory.dmp

Filesize
56KB

Download
memory/4460-274-0x000000001CDA0000-0x000000001D0F0000-memory.dmp

Filesize
3.3MB

Download
memory/4460-236-0x000000001C880000-0x000000001C9A0000-memory.dmp

Filesize
1.1MB

Download
memory/4460-222-0x0000000002780000-0x00000000027AB000-memory.dmp

Filesize
172KB

Download
memory/4460-221-0x000000001B170000-0x000000001B272000-memory.dmp

Filesize
1.0MB

Download
memory/4844-225-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-224-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-223-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-231-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-235-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-234-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-233-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-232-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-230-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-229-0x00000292557C0000-0x00000292557C1000-memory.dmp

Filesize
4KB

Download
memory/4844-220-0x00007FF969CA0000-0x00007FF96A761000-memory.dmp

Filesize
10.8MB

Download
memory/4844-116-0x00007FF969CA3000-0x00007FF969CA5000-memory.dmp

Filesize
8KB

Download
memory/4844-117-0x0000000000C00000-0x0000000000CA6000-memory.dmp

Filesize
664KB

Download
memory/4844-119-0x00007FF969CA0000-0x00007FF96A761000-memory.dmp

Filesize
10.8MB

Download