asyncrat | 98829bbf9afb89501d6d201d5fcaa8807998ce88afc46be1251e933853ac1e9e

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe
Size

1.6MB
MD5

6dabcc4315aec87869a8f89f0207b9ec
SHA1

25796d8f144f0287c0218c7aa448f4f914891fc1
SHA256

c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419
SHA512

336ac664d71ec9c4e044b921f4dca64e6283024412c38e4dbdcced21ccc7fef6684213b9a69092dced322a557e05aff7066bbc762856af2bd71d7d4935840a15
SSDEEP

24576:q74oSZSYH/O+sIV8aUgibdu5Hrll117UXDpLAZCR1:q74xpRs7aUgibduNRlb0lH

Score

10^/10

asyncrat xworm default persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

3.1

Attributes

Install_directory
%ProgramData%
install_file
SecurityHealthSystray.exe
telegram
https://api.telegram.org/bot5370417334:AAEZrEauqhTNZInhZ9_-SaapQJIi0hIvjJU

Extracted

Family

asyncrat

Botnet

Default

Mutex

尺vcΕ贼2C伊R开tΗKTتDmF尺

Attributes

c2_url_file
https://fvia.app/ip2.txt
delay
5
install
false
install_folder
%Windows%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/memory/984-44-0x0000000000F90000-0x0000000000FF4000-memory.dmp	family_xworm
behavioral2/files/0x0003000000022764-35.dat	family_xworm
behavioral2/files/0x0003000000022764-34.dat	family_xworm
behavioral2/files/0x0003000000022764-28.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/1764-129-0x0000000000400000-0x0000000000422000-memory.dmp	asyncrat

Blocklisted process makes network request 2 IoCs

flow	pid	Process
24	4080	WScript.exe
32	4080	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	WindowsSecurity.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation	Seting.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk	WindowsSecurity.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity.lnk	WindowsSecurity.exe

Executes dropped EXE 11 IoCs

pid	Process
1628	Seting.exe
5116	dow.exe
984	WindowsSecurity.exe
2308	ntoskrn.exe
2040	Conhost.exe
4192	RuntimeBroker.exe
2212	Security.exe
4632	ship.exe
3260	Registry Editor.exe
4400	WindowsSecurity.exe
2560	WindowsSecurity.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurity = "C:\\ProgramData\\WindowsSecurity.exe"	WindowsSecurity.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3260 set thread context of 1764	3260	Registry Editor.exe	51

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	dow.exe
File opened for modification	C:\Windows\svchost.exe	ntoskrn.exe
File opened for modification	C:\Windows\svchost.exe	Conhost.exe
File opened for modification	C:\Windows\svchost.exe	RuntimeBroker.exe
File created	C:\Windows\svchost.exe	Security.exe
File opened for modification	C:\Windows\svchost.exe	ship.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3028	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings	Seting.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
448	powershell.exe
448	powershell.exe
448	powershell.exe
4124	powershell.exe
4124	powershell.exe
4124	powershell.exe
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe
456	powershell.exe
456	powershell.exe
456	powershell.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe
1764	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	984	WindowsSecurity.exe
Token: SeDebugPrivilege	448	powershell.exe
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeDebugPrivilege	1764	RegAsm.exe
Token: SeDebugPrivilege	1764	RegAsm.exe
Token: SeDebugPrivilege	984	WindowsSecurity.exe
Token: SeDebugPrivilege	4400	WindowsSecurity.exe
Token: SeDebugPrivilege	2560	WindowsSecurity.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
984	WindowsSecurity.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 1628	4016	c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe	20
PID 4016 wrote to memory of 1628	4016	c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe	20
PID 4016 wrote to memory of 1628	4016	c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe	20
PID 1628 wrote to memory of 448	1628	Seting.exe	44
PID 1628 wrote to memory of 448	1628	Seting.exe	44
PID 1628 wrote to memory of 448	1628	Seting.exe	44
PID 1628 wrote to memory of 5116	1628	Seting.exe	57
PID 1628 wrote to memory of 5116	1628	Seting.exe	57
PID 1628 wrote to memory of 5116	1628	Seting.exe	57
PID 1628 wrote to memory of 984	1628	Seting.exe	47
PID 1628 wrote to memory of 984	1628	Seting.exe	47
PID 1628 wrote to memory of 2308	1628	Seting.exe	56
PID 1628 wrote to memory of 2308	1628	Seting.exe	56
PID 1628 wrote to memory of 2308	1628	Seting.exe	56
PID 1628 wrote to memory of 2040	1628	Seting.exe	100
PID 1628 wrote to memory of 2040	1628	Seting.exe	100
PID 1628 wrote to memory of 2040	1628	Seting.exe	100
PID 1628 wrote to memory of 4192	1628	Seting.exe	54
PID 1628 wrote to memory of 4192	1628	Seting.exe	54
PID 1628 wrote to memory of 4192	1628	Seting.exe	54
PID 1628 wrote to memory of 2212	1628	Seting.exe	53
PID 1628 wrote to memory of 2212	1628	Seting.exe	53
PID 1628 wrote to memory of 2212	1628	Seting.exe	53
PID 1628 wrote to memory of 4632	1628	Seting.exe	48
PID 1628 wrote to memory of 4632	1628	Seting.exe	48
PID 1628 wrote to memory of 4632	1628	Seting.exe	48
PID 1628 wrote to memory of 3260	1628	Seting.exe	49
PID 1628 wrote to memory of 3260	1628	Seting.exe	49
PID 1628 wrote to memory of 3260	1628	Seting.exe	49
PID 1628 wrote to memory of 4080	1628	Seting.exe	50
PID 1628 wrote to memory of 4080	1628	Seting.exe	50
PID 1628 wrote to memory of 4080	1628	Seting.exe	50
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 3260 wrote to memory of 1764	3260	Registry Editor.exe	51
PID 984 wrote to memory of 4124	984	WindowsSecurity.exe	99
PID 984 wrote to memory of 4124	984	WindowsSecurity.exe	99
PID 984 wrote to memory of 5048	984	WindowsSecurity.exe	108
PID 984 wrote to memory of 5048	984	WindowsSecurity.exe	108
PID 984 wrote to memory of 456	984	WindowsSecurity.exe	109
PID 984 wrote to memory of 456	984	WindowsSecurity.exe	109
PID 984 wrote to memory of 3028	984	WindowsSecurity.exe	113
PID 984 wrote to memory of 3028	984	WindowsSecurity.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe
"C:\Users\Admin\AppData\Local\Temp\c8dd8464008d24fe02938509eb3163f09749e1c76bff6dcfd25b1d3193357419.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4016
- C:\ProgramData\Seting.exe
  "C:\ProgramData\Seting.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAYwBwACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAcgBzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGgAZABuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcwB4ACMAPgA="
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- - C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe
    "C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4124
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSecurity.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\WindowsSecurity.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:456
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSecurity" /tr "C:\ProgramData\WindowsSecurity.exe"
      4⤵
      Creates scheduled task(s)
      PID:3028
- - C:\Users\Admin\AppData\Roaming\ship.exe
    "C:\Users\Admin\AppData\Roaming\ship.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4632
- - C:\Users\Admin\AppData\Roaming\Registry Editor.exe
    "C:\Users\Admin\AppData\Roaming\Registry Editor.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1764
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\powershell.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:4080
- - C:\Users\Admin\AppData\Roaming\Security.exe
    "C:\Users\Admin\AppData\Roaming\Security.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2212
- - C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
    "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:4192
- - C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe
    "C:\Users\Admin\AppData\Roaming\SecurityHealthSystray.exe"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Roaming\ntoskrn.exe
    "C:\Users\Admin\AppData\Roaming\ntoskrn.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2308
- - C:\Users\Admin\AppData\Local\dow.exe
    "C:\Users\Admin\AppData\Local\dow.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:5116

C:\ProgramData\WindowsSecurity.exe
C:\ProgramData\WindowsSecurity.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\ProgramData\WindowsSecurity.exe
C:\ProgramData\WindowsSecurity.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Seting.exe

Filesize
382KB

MD5
97752a5b746ebe8343bf72b1d54befb0

SHA1
62ab9351ed95e5698edfffb52ece340b817d383c

SHA256
87983c5c44ada562b2401f55ee5850ed01b4ce065c03ceaf1668504010eb0fa0

SHA512
712f034ffcb1c074b487db43d4223c6a8b6eb570993bd42082ba463758f23a849bb8874c9ccaba6a4f24c2f165657e55134376e183f798070ced9aaf7b0a2de5

Download Submit
C:\ProgramData\Seting.exe

Filesize
91KB

MD5
b570b1b72a2873d81f2eae8e0e08b3fd

SHA1
c1910dd2ef5722acb6866c2119ed9fb1c74e7cd9

SHA256
4cce400bfa7e73b53b4c2d2a35ab5285f5553f517dda648a174fd8275a17bf2a

SHA512
eb156f622d7dee5377cacafcefe0a6d2369968827527197bd290f4c58448b92a0e734dbf837f1851f6e4625989249ae90b1560a048f62dc11881fc1834160743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WindowsSecurity.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\dow.exe

Filesize
60KB

MD5
6e640664f19b746e370f16c205f349fe

SHA1
05333fd1455c1a316682b14c3aecfd0591260df0

SHA256
91eedf2fdb0d1a5c41b3fc7c9e6d50ba7f09a1456688847d446c5d9295614454

SHA512
99437864de9375044d715f90fe24e47457c8af54e5f5ac8eb57943128f717246a78c10dc6ded8a55926eb6c690178138ce14ef9f48552cc62b8505f9190a1e58

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

Filesize
375KB

MD5
216ef921adac2bbb51ff6331f61b19e7

SHA1
90c3cfc3b78daa2bfa12d26dbd765fbfd4bc510d

SHA256
5d717d35b913ff6d13c408f294d899ca58bb321598426eca2bea71b9e6edd9ce

SHA512
33b817fe0b8bcca66173dd293de6a4926b5195a990ee575a378eb4c71610dc68bb3e36b70f4498bd8a2fc9d12283b05a8fd296d2108554105f0e49fdb9e89f0c

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsSecurity.exe

Filesize
92KB

MD5
cb26677c2c8afa055da9ab0cc43fcf97

SHA1
dee9ced8652208ffd8023613f0c78ff6519141c7

SHA256
af7f49fab62b95d68d20eef55895f1f842f457aa04707530adbfa6fc2a3054c6

SHA512
1d2e77d808730ef1451c2b1085475dc513e4613295e7f17ea68bb15394e0b6e5aac6b7325d68e15e47d7cd90bb2d09e0e2194fcbebbee99d4db67a51806384a4

Download Submit
memory/448-136-0x0000000006080000-0x00000000060E6000-memory.dmp

Filesize
408KB

Download
memory/448-147-0x0000000006280000-0x00000000065D4000-memory.dmp

Filesize
3.3MB

Download
memory/448-120-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/448-182-0x0000000007690000-0x0000000007733000-memory.dmp

Filesize
652KB

Download
memory/448-123-0x0000000003030000-0x0000000003066000-memory.dmp

Filesize
216KB

Download
memory/448-165-0x0000000006C00000-0x0000000006C32000-memory.dmp

Filesize
200KB

Download
memory/448-125-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/448-126-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/448-167-0x000000006FD90000-0x000000006FDDC000-memory.dmp

Filesize
304KB

Download
memory/448-197-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/448-131-0x0000000005900000-0x0000000005F28000-memory.dmp

Filesize
6.2MB

Download
memory/448-199-0x0000000007940000-0x000000000795A000-memory.dmp

Filesize
104KB

Download
memory/448-222-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/448-210-0x0000000007B40000-0x0000000007B51000-memory.dmp

Filesize
68KB

Download
memory/448-163-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/448-179-0x000000007F860000-0x000000007F870000-memory.dmp

Filesize
64KB

Download
memory/448-207-0x0000000007BD0000-0x0000000007C66000-memory.dmp

Filesize
600KB

Download
memory/448-196-0x0000000007FC0000-0x000000000863A000-memory.dmp

Filesize
6.5MB

Download
memory/448-230-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

Filesize
80KB

Download
memory/448-232-0x0000000007D00000-0x0000000007D08000-memory.dmp

Filesize
32KB

Download
memory/448-231-0x0000000007D10000-0x0000000007D2A000-memory.dmp

Filesize
104KB

Download
memory/448-236-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/448-134-0x0000000005380000-0x00000000053A2000-memory.dmp

Filesize
136KB

Download
memory/448-178-0x0000000006BE0000-0x0000000006BFE000-memory.dmp

Filesize
120KB

Download
memory/448-198-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/448-229-0x0000000007BC0000-0x0000000007BCE000-memory.dmp

Filesize
56KB

Download
memory/448-135-0x0000000005FA0000-0x0000000006006000-memory.dmp

Filesize
408KB

Download
memory/448-148-0x00000000066B0000-0x00000000066CE000-memory.dmp

Filesize
120KB

Download
memory/448-149-0x0000000006760000-0x00000000067AC000-memory.dmp

Filesize
304KB

Download
memory/448-204-0x00000000079B0000-0x00000000079BA000-memory.dmp

Filesize
40KB

Download
memory/448-162-0x0000000003020000-0x0000000003030000-memory.dmp

Filesize
64KB

Download
memory/456-211-0x0000019EFE440000-0x0000019EFE450000-memory.dmp

Filesize
64KB

Download
memory/456-223-0x0000019EFE440000-0x0000019EFE450000-memory.dmp

Filesize
64KB

Download
memory/456-209-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/456-227-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/984-208-0x000000001BD20000-0x000000001BD30000-memory.dmp

Filesize
64KB

Download
memory/984-137-0x000000001BD20000-0x000000001BD30000-memory.dmp

Filesize
64KB

Download
memory/984-44-0x0000000000F90000-0x0000000000FF4000-memory.dmp

Filesize
400KB

Download
memory/984-59-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/984-166-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/1764-133-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/1764-202-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/1764-129-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1764-203-0x0000000005700000-0x0000000005710000-memory.dmp

Filesize
64KB

Download
memory/2040-92-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2212-94-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2308-58-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2560-253-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/3260-132-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/3260-127-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/3260-121-0x0000000000D10000-0x0000000000D2C000-memory.dmp

Filesize
112KB

Download
memory/3260-128-0x0000000005640000-0x00000000056DC000-memory.dmp

Filesize
624KB

Download
memory/3260-124-0x0000000073C30000-0x00000000743E0000-memory.dmp

Filesize
7.7MB

Download
memory/4016-1-0x00007FFB9C070000-0x00007FFB9CB31000-memory.dmp

Filesize
10.8MB

Download
memory/4016-13-0x00007FFB9C070000-0x00007FFB9CB31000-memory.dmp

Filesize
10.8MB

Download
memory/4016-0-0x0000000000F30000-0x00000000010D4000-memory.dmp

Filesize
1.6MB

Download
memory/4124-155-0x000001CEDF4E0000-0x000001CEDF502000-memory.dmp

Filesize
136KB

Download
memory/4124-164-0x000001CEDEAF0000-0x000001CEDEB00000-memory.dmp

Filesize
64KB

Download
memory/4124-156-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4124-173-0x000001CEDEAF0000-0x000001CEDEB00000-memory.dmp

Filesize
64KB

Download
memory/4124-183-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4124-161-0x000001CEDEAF0000-0x000001CEDEB00000-memory.dmp

Filesize
64KB

Download
memory/4192-93-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4400-247-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4400-250-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/4632-113-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5048-206-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/5048-201-0x00000263B4830000-0x00000263B4840000-memory.dmp

Filesize
64KB

Download
memory/5048-194-0x00007FFB9BC10000-0x00007FFB9C6D1000-memory.dmp

Filesize
10.8MB

Download
memory/5048-195-0x00000263B4830000-0x00000263B4840000-memory.dmp

Filesize
64KB

Download
memory/5116-38-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download