asyncrat | c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894

Analysis

max time kernel
138s
max time network
148s
platform
windows10_x64
resource
win10
submitted
14/10/2020, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
806934432d6829ff5a0277ec0d4e3e36.exe
Size 1.4MB
Sample201014-9ba1532fex
SHA256 c3c2a6747a34c92023bef1d5abc604f697408e60ee64d1155af7a8c62727e894
MD5 806934432d6829ff5a0277ec0d4e3e36
SHA1 a9a2f97a46fcd667ffd21f9ff3091f7d53db01b3
SHA512 0396bfd038caf2d023182beb46ca0b99620418b5beee4ae3a16814593d385b4b6b358426e3c739ce796671d29f711239c4d40e9c3c6883806140779c1e8c88b4
MD5 SHA1 SHA512

Score

10^/10

asyncrat azorult oski raccoon ee3b370277b98939f8098234def6cb188c03591f discovery evasion infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

ee3b370277b98939f8098234def6cb188c03591f

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

oski

jamesrlon.ug

Extracted

Family

asyncrat

Version

0.5.7B

agentttt.ac.ug:6970
agentpurple.ac.ug:6970

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
s8CEqY6pD21gSg7xELYD1QWGg2YpwLUB
anti_detection
false
autorun
false
bdos
false
delay
Default
host
agentttt.ac.ug,agentpurple.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 4 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/2388-85-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral2/memory/2404-86-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral2/memory/2388-87-0x000000000040616E-mapping.dmp	disable_win_def
behavioral2/memory/2404-88-0x0000000000403BEE-mapping.dmp	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2512-71-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral2/memory/2512-73-0x000000000040C75E-mapping.dmp	asyncrat

Downloads MZ/PE file

Executes dropped EXE 12 IoCs

pid	Process
580	Nhrdgfertqw.exe
204	GFsdfgytrqwe.exe
3456	Nhrdgfertqw.exe
900	GFsdfgytrqwe.exe
1120	0yHQ5tfOAc.exe
3388	u6dkJovcJi.exe
3676	HsMWDO60aP.exe
2312	tLHBWn6ptm.exe
2516	0yHQ5tfOAc.exe
2512	0yHQ5tfOAc.exe
2404	tLHBWn6ptm.exe
2388	HsMWDO60aP.exe

Loads dropped DLL 11 IoCs

pid	Process
900	GFsdfgytrqwe.exe
900	GFsdfgytrqwe.exe
900	GFsdfgytrqwe.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe
3964	806934432d6829ff5a0277ec0d4e3e36.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	tLHBWn6ptm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	tLHBWn6ptm.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\LocalLow\FLesFFxEsEs\desktop.ini	806934432d6829ff5a0277ec0d4e3e36.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 792 set thread context of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	74
PID 580 set thread context of 3456	580	Nhrdgfertqw.exe	75
PID 204 set thread context of 900	204	GFsdfgytrqwe.exe	76
PID 1120 set thread context of 2512	1120	0yHQ5tfOAc.exe	95
PID 3676 set thread context of 2388	3676	HsMWDO60aP.exe	96
PID 2312 set thread context of 2404	2312	tLHBWn6ptm.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 1 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	GFsdfgytrqwe.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3320	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1336	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1120	0yHQ5tfOAc.exe
1120	0yHQ5tfOAc.exe
3812	Powershell.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe
2388	HsMWDO60aP.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
792	806934432d6829ff5a0277ec0d4e3e36.exe
580	Nhrdgfertqw.exe
204	GFsdfgytrqwe.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1336	taskkill.exe
Token: SeDebugPrivilege	1120	0yHQ5tfOAc.exe
Token: SeDebugPrivilege	3676	HsMWDO60aP.exe
Token: SeDebugPrivilege	2312	tLHBWn6ptm.exe
Token: SeDebugPrivilege	3812	Powershell.exe
Token: SeDebugPrivilege	2388	HsMWDO60aP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
792	806934432d6829ff5a0277ec0d4e3e36.exe
580	Nhrdgfertqw.exe
204	GFsdfgytrqwe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 580	792	806934432d6829ff5a0277ec0d4e3e36.exe	72
PID 792 wrote to memory of 580	792	806934432d6829ff5a0277ec0d4e3e36.exe	72
PID 792 wrote to memory of 580	792	806934432d6829ff5a0277ec0d4e3e36.exe	72
PID 792 wrote to memory of 204	792	806934432d6829ff5a0277ec0d4e3e36.exe	73
PID 792 wrote to memory of 204	792	806934432d6829ff5a0277ec0d4e3e36.exe	73
PID 792 wrote to memory of 204	792	806934432d6829ff5a0277ec0d4e3e36.exe	73
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	74
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	74
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	74
PID 792 wrote to memory of 3964	792	806934432d6829ff5a0277ec0d4e3e36.exe	74
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	75
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	75
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	75
PID 580 wrote to memory of 3456	580	Nhrdgfertqw.exe	75
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	76
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	76
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	76
PID 204 wrote to memory of 900	204	GFsdfgytrqwe.exe	76
PID 900 wrote to memory of 2880	900	GFsdfgytrqwe.exe	79
PID 900 wrote to memory of 2880	900	GFsdfgytrqwe.exe	79
PID 900 wrote to memory of 2880	900	GFsdfgytrqwe.exe	79
PID 2880 wrote to memory of 1336	2880	cmd.exe	81
PID 2880 wrote to memory of 1336	2880	cmd.exe	81
PID 2880 wrote to memory of 1336	2880	cmd.exe	81
PID 3964 wrote to memory of 1120	3964	806934432d6829ff5a0277ec0d4e3e36.exe	85
PID 3964 wrote to memory of 1120	3964	806934432d6829ff5a0277ec0d4e3e36.exe	85
PID 3964 wrote to memory of 1120	3964	806934432d6829ff5a0277ec0d4e3e36.exe	85
PID 3964 wrote to memory of 3388	3964	806934432d6829ff5a0277ec0d4e3e36.exe	86
PID 3964 wrote to memory of 3388	3964	806934432d6829ff5a0277ec0d4e3e36.exe	86
PID 3964 wrote to memory of 3388	3964	806934432d6829ff5a0277ec0d4e3e36.exe	86
PID 3964 wrote to memory of 3676	3964	806934432d6829ff5a0277ec0d4e3e36.exe	87
PID 3964 wrote to memory of 3676	3964	806934432d6829ff5a0277ec0d4e3e36.exe	87
PID 3964 wrote to memory of 3676	3964	806934432d6829ff5a0277ec0d4e3e36.exe	87
PID 3964 wrote to memory of 2312	3964	806934432d6829ff5a0277ec0d4e3e36.exe	88
PID 3964 wrote to memory of 2312	3964	806934432d6829ff5a0277ec0d4e3e36.exe	88
PID 3964 wrote to memory of 2312	3964	806934432d6829ff5a0277ec0d4e3e36.exe	88
PID 3964 wrote to memory of 3732	3964	806934432d6829ff5a0277ec0d4e3e36.exe	89
PID 3964 wrote to memory of 3732	3964	806934432d6829ff5a0277ec0d4e3e36.exe	89
PID 3964 wrote to memory of 3732	3964	806934432d6829ff5a0277ec0d4e3e36.exe	89
PID 3732 wrote to memory of 3320	3732	cmd.exe	91
PID 3732 wrote to memory of 3320	3732	cmd.exe	91
PID 3732 wrote to memory of 3320	3732	cmd.exe	91
PID 1120 wrote to memory of 3812	1120	0yHQ5tfOAc.exe	92
PID 1120 wrote to memory of 3812	1120	0yHQ5tfOAc.exe	92
PID 1120 wrote to memory of 3812	1120	0yHQ5tfOAc.exe	92
PID 1120 wrote to memory of 2516	1120	0yHQ5tfOAc.exe	94
PID 1120 wrote to memory of 2516	1120	0yHQ5tfOAc.exe	94
PID 1120 wrote to memory of 2516	1120	0yHQ5tfOAc.exe	94
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 1120 wrote to memory of 2512	1120	0yHQ5tfOAc.exe	95
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	96
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	96
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	96
PID 2312 wrote to memory of 2404	2312	tLHBWn6ptm.exe	97
PID 2312 wrote to memory of 2404	2312	tLHBWn6ptm.exe	97
PID 2312 wrote to memory of 2404	2312	tLHBWn6ptm.exe	97
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	96
PID 3676 wrote to memory of 2388	3676	HsMWDO60aP.exe	96

C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe
"C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
  "C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe
    "C:\Users\Admin\AppData\Local\Temp\Nhrdgfertqw.exe"
    3⤵
    - Executes dropped EXE
    PID:3456
- C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
  "C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe
    "C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /pid 900 & erase C:\Users\Admin\AppData\Local\Temp\GFsdfgytrqwe.exe & RD /S /Q C:\\ProgramData\\572453891085442\\* & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /pid 900
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1336
- C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe
  "C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe"
  2⤵
  - Loads dropped DLL
  - Drops desktop.ini file(s)
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe
    "C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddcvlc.exe"'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe
      "C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe"
      4⤵
      Executes dropped EXE
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe
      "C:\Users\Admin\AppData\Local\Temp\0yHQ5tfOAc.exe"
      4⤵
      Executes dropped EXE
      PID:2512
- - C:\Users\Admin\AppData\Local\Temp\u6dkJovcJi.exe
    "C:\Users\Admin\AppData\Local\Temp\u6dkJovcJi.exe"
    3⤵
    - Executes dropped EXE
    PID:3388
- - C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe
    "C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe
      "C:\Users\Admin\AppData\Local\Temp\HsMWDO60aP.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2388
    - - \??\c:\windows\SysWOW64\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\1npihvat.inf
        5⤵
        
        PID:2200
- - C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe
    "C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe
      "C:\Users\Admin\AppData\Local\Temp\tLHBWn6ptm.exe"
      4⤵
      Executes dropped EXE
      Windows security modification
      PID:2404
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        5⤵
        
        PID:1252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\806934432d6829ff5a0277ec0d4e3e36.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3732
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 10 /NOBREAK
      4⤵
      Delays execution with timeout.exe
      PID:3320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-22-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/900-18-0x0000000000400000-0x0000000000438000-memory.dmp

Download

memory/1120-45-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/1120-47-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/1120-67-0x0000000002DE0000-0x0000000002DFA000-memory.dmp

Download

memory/1120-69-0x0000000005300000-0x000000000530D000-memory.dmp

Download

memory/1252-106-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/2200-108-0x00000000044E0000-0x00000000044E1000-memory.dmp

Download

memory/2200-110-0x00000000045F0000-0x00000000045F1000-memory.dmp

Download

memory/2312-65-0x0000000002630000-0x0000000002631000-memory.dmp

Download

memory/2312-62-0x0000000000410000-0x0000000000411000-memory.dmp

Download

memory/2312-60-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/2312-81-0x000000000A310000-0x000000000A324000-memory.dmp

Download

memory/2388-85-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2388-101-0x00000000055E0000-0x00000000055E1000-memory.dmp

Download

memory/2388-98-0x00000000059F0000-0x00000000059F1000-memory.dmp

Download

memory/2388-93-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/2404-86-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2404-92-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/2512-77-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/2512-71-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3456-19-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3456-14-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3676-64-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/3676-54-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/3676-82-0x0000000005790000-0x00000000057A6000-memory.dmp

Download

memory/3676-57-0x0000000000E80000-0x0000000000E81000-memory.dmp

Download

memory/3812-75-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/3812-100-0x0000000006D70000-0x0000000006D71000-memory.dmp

Download

memory/3812-72-0x0000000071540000-0x0000000071C2E000-memory.dmp

Download

memory/3812-103-0x0000000007730000-0x0000000007731000-memory.dmp

Download

memory/3812-105-0x0000000006E40000-0x0000000006E41000-memory.dmp

Download

memory/3812-78-0x0000000006EB0000-0x0000000006EB1000-memory.dmp

Download

memory/3812-107-0x00000000077A0000-0x00000000077A1000-memory.dmp

Download

memory/3964-15-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3964-10-0x0000000000400000-0x0000000000497000-memory.dmp

Download