quasar | 83c4a5e97fbecfb93ef4ac297ce8e6870da08a2e69b8ccd54e730ebb9928eed6

Analysis

user interaction
yes
max time kernel
276s
max time network
277s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
19/04/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client-built.exe
Size 3.1MB
Sample260419-vr61ssfs4q
SHA256 83c4a5e97fbecfb93ef4ac297ce8e6870da08a2e69b8ccd54e730ebb9928eed6
MD5 2612a2646ee5ba277d96452c010232ac
SHA1 1070f8f60b6e2b031edccc0663d9c97c4077986d
SHA512 a2ca037ac700ee093a76500cc69d9d3e07731e8ad97dda32d7c4f57c3b37015a65b8b024e5cb298f8a7288a7628f153fb4815e3e69d7c5078cee8b1ef6e7fd12
SSDEEP 49152:Qv+D/2oga6ctePEl3s3jn7HZkgiORJ6dbR3LoGdlX6THHB72eh2NT:Qv4/2oga6ctePEl3s3L7HZkgiORJ6v
TLSH
T1D5E56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B6581677A1C53B5098026A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

office04 execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

thankyou.servehalflife.com:4782

Mutex

1fda2b73-e6b9-46ba-bb0c-ffaa6ca06f90

Attributes

encryption_key
64956975C2CBF5FD86285F0720015586D1DFDD42
install_name
Microsoft_sql_server.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Microsoft Realtek
subdirectory
MicrosoftWindowsSecurity

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/5112-0-0x00000000009B0000-0x0000000000CD8000-memory.dmp	family_quasar
behavioral1/files/0x00080000000284ca-2.dat	family_quasar

Executes dropped EXE 2 IoCs

pid	Process
4836	Microsoft_sql_server.exe
2152	Microsoft_sql_server.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe	Client-built.exe
File opened for modification	C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe	Client-built.exe
File opened for modification	C:\Windows\system32\MicrosoftWindowsSecurity	Client-built.exe
File opened for modification	C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe	Microsoft_sql_server.exe
File opened for modification	C:\Windows\system32\MicrosoftWindowsSecurity	Microsoft_sql_server.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
636	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-880639880-2214913997-617214392-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4956	schtasks.exe
4852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
5884	taskmgr.exe
5884	taskmgr.exe
5884	taskmgr.exe
5884	taskmgr.exe
5884	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	Client-built.exe
Token: SeDebugPrivilege	4836	Microsoft_sql_server.exe
Token: SeDebugPrivilege	2152	Microsoft_sql_server.exe
Token: SeDebugPrivilege	3952	taskmgr.exe
Token: SeSystemProfilePrivilege	3952	taskmgr.exe
Token: SeCreateGlobalPrivilege	3952	taskmgr.exe
Token: SeDebugPrivilege	3892	Client-built.exe
Token: 33	3952	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3952	taskmgr.exe
Token: SeDebugPrivilege	5060	Client-built.exe
Token: SeDebugPrivilege	6112	Client-built.exe
Token: SeDebugPrivilege	3852	Client-built.exe
Token: SeDebugPrivilege	3748	Client-built.exe
Token: SeDebugPrivilege	5884	taskmgr.exe
Token: SeSystemProfilePrivilege	5884	taskmgr.exe
Token: SeCreateGlobalPrivilege	5884	taskmgr.exe
Token: 33	5884	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5884	taskmgr.exe
Token: SeDebugPrivilege	4892	Client-built.exe
Token: SeDebugPrivilege	3508	firefox.exe
Token: SeDebugPrivilege	3508	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe
3952	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3508	firefox.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4852	5112	Client-built.exe	82
PID 5112 wrote to memory of 4836	5112	Client-built.exe	84
PID 4836 wrote to memory of 4956	4836	Microsoft_sql_server.exe	85
PID 4084 wrote to memory of 636	4084	cmd.exe	116
PID 2616 wrote to memory of 3508	2616	firefox.exe	119
PID 2616 wrote to memory of 3508	2616	firefox.exe	119
PID 3508 wrote to memory of 5424	3508	firefox.exe	120
PID 3508 wrote to memory of 5424	3508	firefox.exe	120
PID 3508 wrote to memory of 5424	3508	firefox.exe	120
PID 3508 wrote to memory of 708	3508	firefox.exe	121
PID 3508 wrote to memory of 708	3508	firefox.exe	121
PID 3508 wrote to memory of 708	3508	firefox.exe	121
PID 3508 wrote to memory of 708	3508	firefox.exe	121
PID 3508 wrote to memory of 4364	3508	firefox.exe	122
PID 3508 wrote to memory of 4364	3508	firefox.exe	122
PID 3508 wrote to memory of 4364	3508	firefox.exe	122
PID 3508 wrote to memory of 4364	3508	firefox.exe	122
PID 3508 wrote to memory of 4604	3508	firefox.exe	123
PID 3508 wrote to memory of 4604	3508	firefox.exe	123
PID 3508 wrote to memory of 4604	3508	firefox.exe	123
PID 3508 wrote to memory of 740	3508	firefox.exe	124
PID 3508 wrote to memory of 740	3508	firefox.exe	124
PID 3508 wrote to memory of 740	3508	firefox.exe	124
PID 3508 wrote to memory of 740	3508	firefox.exe	124
PID 3508 wrote to memory of 2648	3508	firefox.exe	125
PID 3508 wrote to memory of 2648	3508	firefox.exe	125
PID 3508 wrote to memory of 2648	3508	firefox.exe	125
PID 3508 wrote to memory of 2648	3508	firefox.exe	125
PID 3508 wrote to memory of 2008	3508	firefox.exe	126
PID 3508 wrote to memory of 2008	3508	firefox.exe	126
PID 3508 wrote to memory of 2008	3508	firefox.exe	126
PID 3508 wrote to memory of 2008	3508	firefox.exe	126
PID 3508 wrote to memory of 2220	3508	firefox.exe	127
PID 3508 wrote to memory of 2220	3508	firefox.exe	127
PID 3508 wrote to memory of 2220	3508	firefox.exe	127
PID 3508 wrote to memory of 2220	3508	firefox.exe	127
PID 3508 wrote to memory of 5808	3508	firefox.exe	128
PID 3508 wrote to memory of 5808	3508	firefox.exe	128
PID 3508 wrote to memory of 5808	3508	firefox.exe	128
PID 3508 wrote to memory of 5808	3508	firefox.exe	128
PID 3508 wrote to memory of 5504	3508	firefox.exe	129
PID 3508 wrote to memory of 5504	3508	firefox.exe	129
PID 3508 wrote to memory of 5504	3508	firefox.exe	129
PID 3508 wrote to memory of 5504	3508	firefox.exe	129
PID 3508 wrote to memory of 4728	3508	firefox.exe	130
PID 3508 wrote to memory of 4728	3508	firefox.exe	130
PID 3508 wrote to memory of 4728	3508	firefox.exe	130
PID 3508 wrote to memory of 4728	3508	firefox.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Microsoft Realtek " /sc ONLOGON /tr "C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4852
- C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe
  "C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Microsoft Realtek " /sc ONLOGON /tr "C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4956

C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe
C:\Windows\system32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2472

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3748

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5884

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:636

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27100 -prefMapHandle 1964 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {16fad80e-8ef6-44d2-a2b3-df691d43f251} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:5424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2424 -prefsLen 27136 -prefMapHandle 2428 -prefMapSize 270279 -ipcHandle 2440 -initialChannelId {a41d769a-3c4d-42a0-a927-3237a9fcf88e} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2736 -prefsLen 27277 -prefMapHandle 2744 -prefMapSize 270279 -jsInitHandle 2748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3640 -initialChannelId {bd3edef8-5ded-4c2d-8b2d-0a97420f5133} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3812 -prefsLen 27277 -prefMapHandle 3816 -prefMapSize 270279 -ipcHandle 2736 -initialChannelId {0765f682-b27f-4193-8ecb-2443960aff4b} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4604
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4328 -prefsLen 34776 -prefMapHandle 4332 -prefMapSize 270279 -jsInitHandle 4336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {13f2d681-13e2-43c8-866e-63a6965241ca} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4832 -prefsLen 34932 -prefMapHandle 4836 -prefMapSize 270279 -ipcHandle 4728 -initialChannelId {4fced733-c69e-4027-ae1f-bdf03a45e217} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:2648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 32952 -prefMapHandle 5064 -prefMapSize 270279 -jsInitHandle 5068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5076 -initialChannelId {3867adc1-cbfd-4d97-8de9-f79500872848} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:2008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5344 -prefsLen 32952 -prefMapHandle 5348 -prefMapSize 270279 -jsInitHandle 5352 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5372 -initialChannelId {390d05f0-bb02-4554-a3bf-e5ae0298134e} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:2220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5400 -prefsLen 32952 -prefMapHandle 5404 -prefMapSize 270279 -jsInitHandle 5408 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5416 -initialChannelId {e6f99ca7-cfda-41cd-a5ed-3732a5c0742d} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6212 -prefsLen 33071 -prefMapHandle 6292 -prefMapSize 270279 -jsInitHandle 6304 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6312 -initialChannelId {13e6ac08-c4cf-49af-9ffa-45c2ca8306b9} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:5504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6916 -prefsLen 33071 -prefMapHandle 6920 -prefMapSize 270279 -jsInitHandle 6924 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6888 -initialChannelId {46d901c3-6023-4068-a727-1fac0fea4394} -parentPid 3508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
TLSH
T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 944B
SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
MD5 6bd369f7c74a28194c991ed1404da30f
SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
TLSH
T18811924A3AC71DB8F37A6D71006991242202B2275CC2D61C4AC4C6A98B35618E476FA8
MD5 SHA1 SHA512 TLSH

Submit Download

Client-built.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client-built.exe.log
Size 1KB
SHA256 cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674
MD5 b08c36ce99a5ed11891ef6fc6d8647e9
SHA1 db95af417857221948eb1882e60f98ab2914bf1d
SHA512 07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea
TLSH
T17821CD7032B6A1D489063F460C6D65C407FF4329B950AE0C7AAC625EDD2B0175F313F2
MD5 SHA1 SHA512 TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\AlternateServices.bin
Size 10KB
SHA256 672374dc914896b9a1c5d47c1dbe94c229fd6e5de49a04f078365d389a50204b
MD5 07fe905d221dba8f8c59dedba2f3c4ec
SHA1 886cd46749160c1be1b773640d4742d44a148fce
SHA512 72d6dd46e2def106f422900f87539012ec44011f57486fd8617c3e7a70fdf66ca478eebe6a9f56d7f7e9024e30c352855ee1b89030bbeac67bbb70251949b2c0
SSDEEP 24:juhMZdXL91GYfti09xqcizY9B+ciA9VvIcib5q9F55A5xci49lwcirv9BbiJi:xGWKzSGKBSVI56Fywp9b
TLSH
T1B02296E72F75A462F096CFB04069794C8C33132965BD91D0C71490F747D6BA9E13ABA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 26132e3c5de28a48a1a882cf899280af3f3adc00c36706fc009754fe00c41036
MD5 d0163b1d38dc274002ab3de98ddeaab3
SHA1 899010ec2b4f3fbdd8e4e3738b09ba5210df84c6
SHA512 22857b36a01eb47bbfa7f53908ec7e672982515b2acb1fce42dca32c0816fa2c4334028e17306eb8c1bedc2a8a705caf6e949421e0b9cf21b1a63581ff706a0e
SSDEEP 192:ys1d66Joz1zgCl6mc0dBOv5zbomZTryjx82:Pd66Joz1zgC1jAbomZTryjH
TLSH
T194E112A8EA38567FD414027BCCB61B404F76389AD84E7F19319D640C2C572DD7A8E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\events\events
Size 1KB
SHA256 3a21766fc426bc145d1f3a5816bbca5f7185ad3e870c7c603fa78878971a41ae
MD5 748f847f3f5d767d53e890bae4a1f710
SHA1 1114230fa6ed9d14126b12d2333ae2bb2fa2487a
SHA512 6184fbaa6a5941ba7dc2160577e19f7843753d2181c602644ff1238ab2e4705ace44e995ee97cc47f7134b0510db15d8c26d7a4dc3f8419b8cb3896cbddfc85a
TLSH
T1E8216A9C39B84D2A69DFE2AC7442028E53A14E0B14CB1C930E02DE8DCD95ED9726A43C
MD5 SHA1 SHA512 TLSH

Submit Download

04d22cd2-842c-4739-9860-cc2eb48e5541

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\04d22cd2-842c-4739-9860-cc2eb48e5541
Size 2KB
SHA256 0c2fafae599e5184b8f7f9781f4f4bac6fa2fc1c7c396596aed3757550ff2240
MD5 fe340dc18c8ac1a4a1082c26a495585c
SHA1 b82015238197126248acff87b5b6449711b7cd53
SHA512 6308501279a2a173221a6a96c7b43be6689cdf66462465d60ca2a4d73c275cfbe5eba507d2dd7c920df3f250edd92f2a15c39d4177bbc250d94f5477ee0b4946
TLSH
T13141345C3A785CBA4C9BF14DE482338D53A04A1E00C22D876E91DE4CCDD56D973AA52B
MD5 SHA1 SHA512 TLSH

Submit Download

1fed6465-23fb-4572-9637-b504fd95339c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\1fed6465-23fb-4572-9637-b504fd95339c
Size 886B
SHA256 17c6a89de85386148865e4d686647423c6eb5b08e1cfce3432323c0e653d2ab0
MD5 93651a6dcecc14a28bcf5c236d941b4b
SHA1 1cca5d1981e80f3f307e978f6d97183a51d7cc11
SHA512 9c4d4fc4a815aa22b3f466b306e74966024eec648ec0d1a71b31ff41c260bbfcf3773f8bf5354980b4fb3c2ed5851eee58778ce5f6ba9c6301abd32361e2fc6c
TLSH
T1941100C59A34BDB2DC38D24B84A5B74287E47023C0CA69187EA55E180DFA56DA35B607
MD5 SHA1 SHA512 TLSH

Submit Download

3cef601d-5722-4168-a3a1-be4e272c2bff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\3cef601d-5722-4168-a3a1-be4e272c2bff
Size 883B
SHA256 d9fa542c4777e6e263a9d52a6fff6a2336a16df35fecd853a67e3ce893507558
MD5 616bfb0884625e9c170fb8bf39892ba9
SHA1 019f61968ba75facfa9c8280791e82dd789bd878
SHA512 ac8faf6b4f1a0b0f43566900fe250399a2903b321297099172b396ee20e00bea0f413baa489709dc06f607f054171fe353e98a6be98f4646d6608838fd74553d
TLSH
T17211008486347EB2DC28A25BC96577464BE4752380CBA5183EB50E184DBE52DC35B64B
MD5 SHA1 SHA512 TLSH

Submit Download

63d82354-a4ef-4f48-bb44-d55f5267c3c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\63d82354-a4ef-4f48-bb44-d55f5267c3c8
Size 2KB
SHA256 006fa4eb823ce576c2ca3f2f2443a31b1c36705924366adcacce8e31ded2baa5
MD5 31c0f42540a8a0257acc4eb5e3294f87
SHA1 ea6ef3ca02cdec76d67ae00c4c1b5012fd176746
SHA512 cde239f56276e1aadeda35387e3f0283a4f195a3a690479cb2d1d8231450ca5a961a3b2c18eb7803e10586359f74bfe1633932e529c85573ceec1bbe4dc20972
TLSH
T1FA51A6698220DC7EC979B31BDC2437828BF3140A408B294EAFECAE0A15BFD5D9359645
MD5 SHA1 SHA512 TLSH

Submit Download

83d9e38c-f9e3-4bde-8760-287dd560b3e2

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\83d9e38c-f9e3-4bde-8760-287dd560b3e2
Size 235B
SHA256 fd5992e0ce8b17b1ff0ab306e9d47f094aa9d9802d008482c2f6a1269915dc68
MD5 b791e107129abc13dc544fd86d7840f9
SHA1 4430644e7ea616ded70da74e017143a9aaa868f6
SHA512 98c67f534ed0ce525125201627e12b127edab085b1224e3d6cd100a061bc927cf3c4bbf0297fd534ede7ccda23be7cb72cdeecb2fa98431f309827961391383d
TLSH
T13ED0978224B863AE08080F17F0E278E230444C3320B86910C5A143B499F9DC94222C16
MD5 SHA1 SHA512 TLSH

Submit Download

f0269762-af26-40a3-bf3f-3457ef31b0ff

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\datareporting\glean\pending_pings\f0269762-af26-40a3-bf3f-3457ef31b0ff
Size 235B
SHA256 a01d16564af7a6d0561c8e285975bcc8c0a812e85723e80cc08de9a32d09a5ea
MD5 02f4dc917f285e826b05b5557ce8287f
SHA1 60386f85e170b828b3694de9c37fd9c9743596d6
SHA512 5e1038b3e6cbfd926be2f5246b843f1bd0b9fc0552ec283d902bb25372301a222ecf261d9f7d9de59b4c59e31a8d6ace5b3ec633a9bd3221089dd5f6500e0951
TLSH
T153D0978014A8A71C48400F0FB0A0A9C6B1944C3314A19C20969084389EFDAC9413280A
MD5 SHA1 SHA512 TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 755918bf92c22a28bfd317c1aaba8101d56fa9c604ed56a4072ad656c131ed94
MD5 bc6db545128960b7aac758ef89a3128a
SHA1 5fed234a41b6576a6cefe916b2eab7425d32ec37
SHA512 60bd1b41498546f5bf197699fe2d627affccd05f1bbe8eea2efc78dc41bc308bf76dbeccaf575874b94381aa2ae791116734f20605f7ad450abbee7810177acf
SSDEEP 24576:mCWk+tIYI0Lgrb63BDcYrVQpa9dfH9E28lQyYH:mjv7LO6pcYrVEa9d/9E2+QyY
TLSH
T1EEF53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\tmuxgznf.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 3.3MB
SHA256 67cceef1c7ed54067ef03569464e6e0f73f84dd8868e4f8988e26f32fe7f6dfd
MD5 de4d19df06b0bd575b3cfdfe7c296940
SHA1 daf366a832b0a1789e502a56c94b69f2736559ef
SHA512 4894902eef9cbc612b361801c58e97b824ee890ec780c74b269e20b91614f2267e34189c8fd9d99cfc41a1865d0af761be7b5fa0553839dc5923e0a2020782d7
SSDEEP 24576:sCW++tIdfnUarz63BDcYrVQpQ9pyi9P28lQyzH:sjUvUs6pcYrVEQ9p39P2+Qyz
TLSH
T156F53BF820D2B357F3418033A64593EB21AFD00C6467DE044BA956E895B9CEF9E05B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft_sql_server.exe

Path C:\Windows\System32\MicrosoftWindowsSecurity\Microsoft_sql_server.exe
Size 3.1MB
SHA256 83c4a5e97fbecfb93ef4ac297ce8e6870da08a2e69b8ccd54e730ebb9928eed6
MD5 2612a2646ee5ba277d96452c010232ac
SHA1 1070f8f60b6e2b031edccc0663d9c97c4077986d
SHA512 a2ca037ac700ee093a76500cc69d9d3e07731e8ad97dda32d7c4f57c3b37015a65b8b024e5cb298f8a7288a7628f153fb4815e3e69d7c5078cee8b1ef6e7fd12
SSDEEP 49152:Qv+D/2oga6ctePEl3s3jn7HZkgiORJ6dbR3LoGdlX6THHB72eh2NT:Qv4/2oga6ctePEl3s3L7HZkgiORJ6v
TLSH
T1D5E56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B6581677A1C53B5098026A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-10-0x0000000000F00000-0x0000000000F0C000-memory.dmp

Download

memory/3748-60-0x00000000018F0000-0x00000000018FC000-memory.dmp

Download

memory/3852-43-0x0000000001530000-0x000000000153C000-memory.dmp

Download

memory/3892-36-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

Download

memory/3952-23-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-27-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-26-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-28-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-22-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-24-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-25-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-17-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-18-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/3952-16-0x0000021B53EE0000-0x0000021B53EE1000-memory.dmp

Download

memory/4836-12-0x0000000002760000-0x0000000002768000-memory.dmp

Download

memory/4836-13-0x000000001B350000-0x000000001B360000-memory.dmp

Download

memory/4836-11-0x0000000002570000-0x000000000257C000-memory.dmp

Download

memory/4836-7-0x000000001C750000-0x000000001C802000-memory.dmp

Download

memory/4836-6-0x00000000027B0000-0x0000000002800000-memory.dmp

Download

memory/4836-5-0x000000001B350000-0x000000001B360000-memory.dmp

Download

memory/4892-91-0x00000000030F0000-0x00000000030FC000-memory.dmp

Download

memory/5060-41-0x00000000011C0000-0x00000000011CC000-memory.dmp

Download

memory/5112-0-0x00000000009B0000-0x0000000000CD8000-memory.dmp

Download

memory/5112-4-0x0000000001480000-0x000000000148C000-memory.dmp

Download

memory/5112-1-0x000000001BA30000-0x000000001BA40000-memory.dmp

Download

memory/6112-42-0x00000000028D0000-0x00000000028DC000-memory.dmp

Download