njrat | dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

Analysis

max time kernel
150s
max time network
185s
platform
windows7_x64
resource
win7v20210408
submitted
16-09-2021 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
Size

91KB
MD5

6b5bc3eba86c9efbdf993773af3f593e
SHA1

0fd0f10d34c28a928e69343caeeed7803646be8f
SHA256

dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07
SHA512

cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7 MultiHost

Botnet

HacKed

anunankis1.duckdns.org,anunankis3.duckdns.org,karmina112.sytes.net,karmina114.sytes.net,burdun.dynu.net,burdun114.dynu.net:1177

Mutex

8746d62c81bb0c573a0a1086f9955c7b

Attributes

reg_key
8746d62c81bb0c573a0a1086f9955c7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 6 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid process

1708 svchost.exe
576 svchost.exe
1752 svchost.exe
1784 svchost.exe
1816 svchost.exe
2044 svchost.exe

pid	process
1708	svchost.exe
576	svchost.exe
1752	svchost.exe
1784	svchost.exe
1816	svchost.exe
2044	svchost.exe

Drops startup file 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8746d62c81bb0c573a0a1086f9955c7b.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CCleaner.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8746d62c81bb0c573a0a1086f9955c7b.exe	svchost.exe

Loads dropped DLL 5 IoCs

Processes:

DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid process

2044 DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
1708 svchost.exe
576 svchost.exe
1752 svchost.exe
1816 svchost.exe

pid	process
2044	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
1708	svchost.exe
576	svchost.exe
1752	svchost.exe
1816	svchost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\8746d62c81bb0c573a0a1086f9955c7b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .."	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\8746d62c81bb0c573a0a1086f9955c7b = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .."	svchost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exesvchost.exesvchost.exesvchost.exe

description	pid	process	target process
PID 2020 set thread context of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 1708 set thread context of 576	1708	svchost.exe	svchost.exe
PID 1752 set thread context of 1784	1752	svchost.exe	svchost.exe
PID 1816 set thread context of 2044	1816	svchost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1304 schtasks.exe

pid	process
1304	schtasks.exe

Suspicious use of AdjustPrivilegeToken 33 IoCs

Processes:

svchost.exe

description	pid	process
Token: SeDebugPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe
Token: 33	576	svchost.exe
Token: SeIncBasePriorityPrivilege	576	svchost.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exeDBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exesvchost.exesvchost.exetaskeng.exesvchost.exesvchost.exe

description	pid	process	target process
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2020 wrote to memory of 2044	2020	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
PID 2044 wrote to memory of 1708	2044	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	svchost.exe
PID 2044 wrote to memory of 1708	2044	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	svchost.exe
PID 2044 wrote to memory of 1708	2044	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	svchost.exe
PID 2044 wrote to memory of 1708	2044	DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 1708 wrote to memory of 576	1708	svchost.exe	svchost.exe
PID 576 wrote to memory of 1304	576	svchost.exe	schtasks.exe
PID 576 wrote to memory of 1304	576	svchost.exe	schtasks.exe
PID 576 wrote to memory of 1304	576	svchost.exe	schtasks.exe
PID 576 wrote to memory of 1304	576	svchost.exe	schtasks.exe
PID 1796 wrote to memory of 1752	1796	taskeng.exe	svchost.exe
PID 1796 wrote to memory of 1752	1796	taskeng.exe	svchost.exe
PID 1796 wrote to memory of 1752	1796	taskeng.exe	svchost.exe
PID 1796 wrote to memory of 1752	1796	taskeng.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1752 wrote to memory of 1784	1752	svchost.exe	svchost.exe
PID 1796 wrote to memory of 1816	1796	taskeng.exe	svchost.exe
PID 1796 wrote to memory of 1816	1796	taskeng.exe	svchost.exe
PID 1796 wrote to memory of 1816	1796	taskeng.exe	svchost.exe
PID 1796 wrote to memory of 1816	1796	taskeng.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe
PID 1816 wrote to memory of 2044	1816	svchost.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
"C:\Users\Admin\AppData\Local\Temp\DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Local\Temp\DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe
"C:\Users\Admin\AppData\Local\Temp\DBD5E126CAD149E95614507E63A255F2B26B9A4E539B7.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
4⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:576

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn Skype /tr "C:\Users\Admin\AppData\Local\Temp\svchost.exe
5⤵
- Creates scheduled task(s)
PID:1304

C:\Windows\system32\taskeng.exe
taskeng.exe {54BA905B-BE3D-43BB-A982-2F86C07D073B} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1752

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Executes dropped EXE
PID:1784

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1816

C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
3⤵
- Executes dropped EXE
PID:2044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6b5bc3eba86c9efbdf993773af3f593e

SHA1
0fd0f10d34c28a928e69343caeeed7803646be8f

SHA256
dbd5e126cad149e95614507e63a255f2b26b9a4e539b7bcd25e7d8a1e2bd6e07

SHA512
cd5c91dc4de88b46384a6c615f6a0da3250a00a34c11221c8dcf9d857fde0ce8cff0a55f8442e2b7a1758d2f7b77b69d7265cc96427f972295124c06095cc3d1

Download Submit
memory/576-77-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/576-73-0x0000000000407AEE-mapping.dmp

Download
memory/1304-78-0x0000000000000000-mapping.dmp

Download
memory/1708-76-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download
memory/1708-67-0x0000000000000000-mapping.dmp

Download
memory/1752-80-0x0000000000000000-mapping.dmp

Download
memory/1752-88-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/1784-85-0x0000000000407AEE-mapping.dmp

Download
memory/1784-89-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/1816-90-0x0000000000000000-mapping.dmp

Download
memory/1816-102-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/2020-61-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/2020-60-0x00000000754F1000-0x00000000754F3000-memory.dmp

Filesize
8KB

Download
memory/2044-63-0x0000000000407AEE-mapping.dmp

Download
memory/2044-65-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/2044-95-0x0000000000407AEE-mapping.dmp

Download
memory/2044-97-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download
memory/2044-100-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download
memory/2044-103-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2044-62-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download