asyncrat | 7e5dd61d1a28a21f3eeaf8ff3723b69019f83be520b6ad986a57b5de05dab438

Analysis

max time kernel
134s
max time network
143s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
Size

480KB
MD5

fd212aeaf2a519e24276516eeb1dedef
SHA1

55bb12aaac948f80f17d0f2b45db7992b92683ce
SHA256

7e5dd61d1a28a21f3eeaf8ff3723b69019f83be520b6ad986a57b5de05dab438
SHA512

8534c379b89c9c4d3f4d37dbe06bbba744e9fde7e5ff53d20eaa88eb166dc3d24e27221445546e849a34678d53b030ee5f58a72f395cf8a5e45d86e64c75508a
SSDEEP

12288:gZycYZmPGAD5HHT6O1FaxE6z1Jy7tMfHEce:gMcYZmeOz6MWE6z1JGtdce

Score

10^/10

asyncrat zgrat 6 rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

185.157.160.147:1973

Mutex

6SI8OkPnk0ut56r

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2332-98-0x00000000080D0000-0x0000000008140000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-99-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-100-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-102-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-104-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-106-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-108-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-110-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-112-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-114-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-116-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-118-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-120-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-122-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-124-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-126-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-128-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-130-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-132-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-134-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-136-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-138-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-140-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-142-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-144-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-146-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-148-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-150-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-152-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-154-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-156-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-158-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-160-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1
behavioral1/memory/2332-162-0x00000000080D0000-0x0000000008139000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe

description	pid	process	target process
PID 2332 set thread context of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exefd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe

pid	process
1692	powershell.exe
2428	powershell.exe
2464	powershell.exe
2004	powershell.exe
1260	powershell.exe
1752	powershell.exe
2084	powershell.exe
780	powershell.exe
756	powershell.exe
3000	powershell.exe
2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeIncreaseQuotaPrivilege	1692	powershell.exe
Token: SeSecurityPrivilege	1692	powershell.exe
Token: SeTakeOwnershipPrivilege	1692	powershell.exe
Token: SeLoadDriverPrivilege	1692	powershell.exe
Token: SeSystemProfilePrivilege	1692	powershell.exe
Token: SeSystemtimePrivilege	1692	powershell.exe
Token: SeProfSingleProcessPrivilege	1692	powershell.exe
Token: SeIncBasePriorityPrivilege	1692	powershell.exe
Token: SeCreatePagefilePrivilege	1692	powershell.exe
Token: SeBackupPrivilege	1692	powershell.exe
Token: SeRestorePrivilege	1692	powershell.exe
Token: SeShutdownPrivilege	1692	powershell.exe
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeSystemEnvironmentPrivilege	1692	powershell.exe
Token: SeRemoteShutdownPrivilege	1692	powershell.exe
Token: SeUndockPrivilege	1692	powershell.exe
Token: SeManageVolumePrivilege	1692	powershell.exe
Token: 33	1692	powershell.exe
Token: 34	1692	powershell.exe
Token: 35	1692	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeIncreaseQuotaPrivilege	2428	powershell.exe
Token: SeSecurityPrivilege	2428	powershell.exe
Token: SeTakeOwnershipPrivilege	2428	powershell.exe
Token: SeLoadDriverPrivilege	2428	powershell.exe
Token: SeSystemProfilePrivilege	2428	powershell.exe
Token: SeSystemtimePrivilege	2428	powershell.exe
Token: SeProfSingleProcessPrivilege	2428	powershell.exe
Token: SeIncBasePriorityPrivilege	2428	powershell.exe
Token: SeCreatePagefilePrivilege	2428	powershell.exe
Token: SeBackupPrivilege	2428	powershell.exe
Token: SeRestorePrivilege	2428	powershell.exe
Token: SeShutdownPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeSystemEnvironmentPrivilege	2428	powershell.exe
Token: SeRemoteShutdownPrivilege	2428	powershell.exe
Token: SeUndockPrivilege	2428	powershell.exe
Token: SeManageVolumePrivilege	2428	powershell.exe
Token: 33	2428	powershell.exe
Token: 34	2428	powershell.exe
Token: 35	2428	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeIncreaseQuotaPrivilege	2464	powershell.exe
Token: SeSecurityPrivilege	2464	powershell.exe
Token: SeTakeOwnershipPrivilege	2464	powershell.exe
Token: SeLoadDriverPrivilege	2464	powershell.exe
Token: SeSystemProfilePrivilege	2464	powershell.exe
Token: SeSystemtimePrivilege	2464	powershell.exe
Token: SeProfSingleProcessPrivilege	2464	powershell.exe
Token: SeIncBasePriorityPrivilege	2464	powershell.exe
Token: SeCreatePagefilePrivilege	2464	powershell.exe
Token: SeBackupPrivilege	2464	powershell.exe
Token: SeRestorePrivilege	2464	powershell.exe
Token: SeShutdownPrivilege	2464	powershell.exe
Token: SeDebugPrivilege	2464	powershell.exe
Token: SeSystemEnvironmentPrivilege	2464	powershell.exe
Token: SeRemoteShutdownPrivilege	2464	powershell.exe
Token: SeUndockPrivilege	2464	powershell.exe
Token: SeManageVolumePrivilege	2464	powershell.exe
Token: 33	2464	powershell.exe
Token: 34	2464	powershell.exe
Token: 35	2464	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

Processes:

fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe

description	pid	process	target process
PID 2332 wrote to memory of 1692	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1692	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1692	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1692	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2428	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2428	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2428	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2428	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2464	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2464	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2464	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2464	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2004	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2004	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2004	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2004	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1260	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1260	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1260	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1260	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 1752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2084	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2084	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2084	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2084	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 780	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 780	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 780	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 780	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 756	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 756	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 756	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 756	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 3000	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 3000	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 3000	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 3000	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	powershell.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
PID 2332 wrote to memory of 2752	2332	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe	fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2428

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1260

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2084

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000

C:\Users\Admin\AppData\Local\Temp\fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\Temp\fd212aeaf2a519e24276516eeb1dedef_JaffaCakes118.exe
2⤵
PID:2752

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
087f291194336243b0fdefa03ed63dba

SHA1
6be3c7e7c94d1905522f4224f6ac03ffe89366f4

SHA256
9c7cfc2b5478a8431b84a54f2e3f89757eb82eeee4badfbfad98e191d32be8d6

SHA512
b4c57bb0fe63bc182df92dfe450c97cdd152b9d1f7e9bde80fe499152d11671be9e45313b4816ac08a39fc9ae96066427e35ff148869b01be9844a372e62c502

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/756-87-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/756-86-0x0000000002AD0000-0x0000000002B10000-memory.dmp

Filesize
256KB

Download
memory/756-83-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/756-84-0x0000000002AD0000-0x0000000002B10000-memory.dmp

Filesize
256KB

Download
memory/756-85-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/780-76-0x0000000002B20000-0x0000000002B60000-memory.dmp

Filesize
256KB

Download
memory/780-77-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/780-75-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/780-74-0x0000000002B20000-0x0000000002B60000-memory.dmp

Filesize
256KB

Download
memory/780-73-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/1260-45-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/1260-48-0x0000000002CD0000-0x0000000002D10000-memory.dmp

Filesize
256KB

Download
memory/1260-47-0x0000000002CD0000-0x0000000002D10000-memory.dmp

Filesize
256KB

Download
memory/1260-49-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/1260-46-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-8-0x000000006F990000-0x000000006FF3B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-7-0x0000000002840000-0x0000000002880000-memory.dmp

Filesize
256KB

Download
memory/1692-6-0x000000006F990000-0x000000006FF3B000-memory.dmp

Filesize
5.7MB

Download
memory/1692-5-0x000000006F990000-0x000000006FF3B000-memory.dmp

Filesize
5.7MB

Download
memory/1752-56-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/1752-55-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/1752-57-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-38-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2004-39-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-37-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/2004-36-0x0000000002790000-0x00000000027D0000-memory.dmp

Filesize
256KB

Download
memory/2004-35-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/2084-64-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2084-66-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2084-65-0x00000000026E0000-0x0000000002720000-memory.dmp

Filesize
256KB

Download
memory/2084-63-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2332-138-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-144-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-2268-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-162-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-160-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-158-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-156-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-154-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-22-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-152-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-150-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-148-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-2-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2332-1-0x0000000074740000-0x0000000074E2E000-memory.dmp

Filesize
6.9MB

Download
memory/2332-146-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-28-0x0000000000350000-0x0000000000390000-memory.dmp

Filesize
256KB

Download
memory/2332-142-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-140-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-97-0x00000000048C0000-0x0000000004908000-memory.dmp

Filesize
288KB

Download
memory/2332-98-0x00000000080D0000-0x0000000008140000-memory.dmp

Filesize
448KB

Download
memory/2332-99-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-100-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-102-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-104-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-106-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-108-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-110-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-112-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-114-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-116-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-118-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-120-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-122-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-124-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-126-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-128-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-130-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-132-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-134-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-136-0x00000000080D0000-0x0000000008139000-memory.dmp

Filesize
420KB

Download
memory/2332-0-0x00000000009E0000-0x0000000000A5E000-memory.dmp

Filesize
504KB

Download
memory/2428-14-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-16-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/2428-15-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-24-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-26-0x0000000002C60000-0x0000000002CA0000-memory.dmp

Filesize
256KB

Download
memory/2464-29-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-27-0x0000000002C60000-0x0000000002CA0000-memory.dmp

Filesize
256KB

Download
memory/2464-23-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2464-25-0x000000006F960000-0x000000006FF0B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-2272-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2752-2273-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2752-2274-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/2752-2275-0x00000000746C0000-0x0000000074DAE000-memory.dmp

Filesize
6.9MB

Download
memory/2752-2276-0x0000000004C40000-0x0000000004C80000-memory.dmp

Filesize
256KB

Download
memory/3000-96-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/3000-93-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/3000-95-0x000000006F6D0000-0x000000006FC7B000-memory.dmp

Filesize
5.7MB

Download
memory/3000-94-0x0000000002AD0000-0x0000000002B10000-memory.dmp

Filesize
256KB

Download