bitrat | f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736

Analysis

max time kernel
110s
max time network
125s
platform
windows10_x64
resource
win10-en-20211208
submitted
07-01-2022 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
Size

2.3MB
MD5

0a7dba172f5485536a67007bbb67f209
SHA1

7352fbbee9419e6afe958bfd34d55ffafeda0d58
SHA256

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736
SHA512

6f2c94a396ed78e925c0d3dd6926498a7ba78bb5a111287b5c0b1122681e196fc526496a433e5b3b431988a5d6eb75218d0b5c814971163dbc489193454d14ba

Score

10^/10

bitrat evasion persistence suricata trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

severdops.ddns.net:3071

Attributes

communication_password
29ef52e7563626a96cea7f4b4085c124
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)
suricata

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/920-168-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/920-173-0x0000000000400000-0x00000000007E5000-memory.dmp	upx
behavioral1/memory/920-180-0x0000000000400000-0x00000000007E5000-memory.dmp	upx

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe = "0"	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe = "0"	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\MURRINEADC = "C:\\Windows\\Microsoft.NET\\Framework\\GLOSSERSECC\\svchost.exe"	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

cvtres.exe

pid process

920 cvtres.exe
920 cvtres.exe
920 cvtres.exe
920 cvtres.exe
920 cvtres.exe

pid	process
920	cvtres.exe
920	cvtres.exe
920	cvtres.exe
920	cvtres.exe
920	cvtres.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

description	pid	process	target process
PID 3592 set thread context of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe

Drops file in Windows directory 1 IoCs

Processes:

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exepowershell.exepowershell.exepowershell.exe

pid	process
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
4216	powershell.exe
4052	powershell.exe
4076	powershell.exe
4052	powershell.exe
4216	powershell.exe
4076	powershell.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
4052	powershell.exe
4216	powershell.exe
4076	powershell.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exepowershell.exepowershell.exepowershell.execvtres.exe

description	pid	process
Token: SeDebugPrivilege	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	4052	powershell.exe
Token: SeShutdownPrivilege	920	cvtres.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

cvtres.exe

pid process

920 cvtres.exe
920 cvtres.exe

pid	process
920	cvtres.exe
920	cvtres.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe

description	pid	process	target process
PID 3592 wrote to memory of 4052	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4052	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4052	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4076	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4076	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4076	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4216	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4216	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 4216	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	powershell.exe
PID 3592 wrote to memory of 656	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	aspnet_state.exe
PID 3592 wrote to memory of 656	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	aspnet_state.exe
PID 3592 wrote to memory of 656	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	aspnet_state.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe
PID 3592 wrote to memory of 920	3592	f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe
"C:\Users\Admin\AppData\Local\Temp\f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe"
1⤵
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\GLOSSERSECC\svchost.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f10d43cfd07a986f1f3c75eb7c90af7e1d841530709f8dcac64bfbfcb53ec736.exe" -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
2⤵
PID:656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
7247129cd0644457905b7d6bf17fd078

SHA1
dbf9139b5a1b72141f170d2eae911bbbe7e128c8

SHA256
dfa6e0d79449f29310b2a0400dc7fa5a3a6b08182233147a81902d1f80a0f8e4

SHA512
9b1ebd7fe485811f10ec02778d90a7f7eccafa0231027b640b94eaed8408107051da7fcc4f17a9aa0eef900fa2595f44be7fd115331fb6da9b10076f5fcf87e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
1d8fcce19dc40169f8bb4a71c02fd23f

SHA1
77cd4c7e6eea58e156ae09bd91ff2125f34f962a

SHA256
05978038366c46b76f769a3c8463bc60ad824ef535cf9077620ecd4552c036b3

SHA512
2bd9f670c3708a5ca4b917ae1da037cbe87ec204a9a8fb4e1af6e8e483f593429c937720fd0efa311d0549fb8b38763c4c88b302616eadfd1aae39b1dc437d36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
cb9593d16734032bd0aca47fc4ff655c

SHA1
91c7571c113e16260b3b9274636f568676ad6eff

SHA256
b79ec4f64bb5d9815b0f68493cada4ee4e9c574d94d804e4a178149c3ed1216e

SHA512
d976eafca1e12ce5577cc5cb0ded1d3a06d0c0536132fb6d1da5354c477f4a50138df2ec0f0caceb625f3d89b2cd6e4e79797b22f463cdacfc5dc14703a53800

Download Submit
memory/920-171-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/920-169-0x00000000007E2730-mapping.dmp

Download
memory/920-180-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/920-173-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/920-172-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/920-168-0x0000000000400000-0x00000000007E5000-memory.dmp

Filesize
3.9MB

Download
memory/3592-124-0x0000000007520000-0x0000000007A1E000-memory.dmp

Filesize
5.0MB

Download
memory/3592-119-0x0000000001C10000-0x0000000001C18000-memory.dmp

Filesize
32KB

Download
memory/3592-118-0x0000000001BF0000-0x0000000001BF8000-memory.dmp

Filesize
32KB

Download
memory/3592-138-0x0000000007250000-0x000000000725A000-memory.dmp

Filesize
40KB

Download
memory/3592-120-0x00000000034D0000-0x00000000034D8000-memory.dmp

Filesize
32KB

Download
memory/3592-117-0x0000000001BE0000-0x0000000001BE8000-memory.dmp

Filesize
32KB

Download
memory/3592-116-0x00000000059E0000-0x0000000005A7C000-memory.dmp

Filesize
624KB

Download
memory/3592-130-0x0000000008250000-0x00000000082E2000-memory.dmp

Filesize
584KB

Download
memory/3592-123-0x0000000006F50000-0x000000000701A000-memory.dmp

Filesize
808KB

Download
memory/3592-122-0x0000000006D40000-0x0000000006F4E000-memory.dmp

Filesize
2.1MB

Download
memory/3592-121-0x0000000005C00000-0x0000000005C01000-memory.dmp

Filesize
4KB

Download
memory/3592-115-0x0000000000E20000-0x0000000001078000-memory.dmp

Filesize
2.3MB

Download
memory/4052-216-0x000000007E870000-0x000000007E871000-memory.dmp

Filesize
4KB

Download
memory/4052-136-0x00000000010B0000-0x00000000010E6000-memory.dmp

Filesize
216KB

Download
memory/4052-209-0x00000000090E0000-0x0000000009113000-memory.dmp

Filesize
204KB

Download
memory/4052-213-0x0000000006F50000-0x0000000006F72000-memory.dmp

Filesize
136KB

Download
memory/4052-139-0x00000000070F0000-0x0000000007718000-memory.dmp

Filesize
6.2MB

Download
memory/4052-149-0x0000000007080000-0x00000000070E6000-memory.dmp

Filesize
408KB

Download
memory/4052-175-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/4052-144-0x0000000006F50000-0x0000000006F72000-memory.dmp

Filesize
136KB

Download
memory/4052-147-0x0000000007010000-0x0000000007076000-memory.dmp

Filesize
408KB

Download
memory/4052-205-0x00000000090E0000-0x0000000009113000-memory.dmp

Filesize
204KB

Download
memory/4052-202-0x00000000070F0000-0x0000000007718000-memory.dmp

Filesize
6.2MB

Download
memory/4052-148-0x0000000001060000-0x0000000001061000-memory.dmp

Filesize
4KB

Download
memory/4052-129-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/4052-128-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/4052-125-0x0000000000000000-mapping.dmp

Download
memory/4052-170-0x0000000008010000-0x0000000008086000-memory.dmp

Filesize
472KB

Download
memory/4052-157-0x00000000078B0000-0x0000000007C00000-memory.dmp

Filesize
3.3MB

Download
memory/4052-165-0x0000000008260000-0x00000000082AB000-memory.dmp

Filesize
300KB

Download
memory/4052-159-0x0000000001062000-0x0000000001063000-memory.dmp

Filesize
4KB

Download
memory/4052-162-0x0000000007D00000-0x0000000007D1C000-memory.dmp

Filesize
112KB

Download
memory/4076-201-0x0000000009710000-0x0000000009743000-memory.dmp

Filesize
204KB

Download
memory/4076-152-0x00000000073A0000-0x00000000073A1000-memory.dmp

Filesize
4KB

Download
memory/4076-155-0x0000000008110000-0x0000000008460000-memory.dmp

Filesize
3.3MB

Download
memory/4076-161-0x0000000008460000-0x000000000847C000-memory.dmp

Filesize
112KB

Download
memory/4076-126-0x0000000000000000-mapping.dmp

Download
memory/4076-131-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/4076-158-0x00000000073A2000-0x00000000073A3000-memory.dmp

Filesize
4KB

Download
memory/4076-164-0x00000000085E0000-0x000000000862B000-memory.dmp

Filesize
300KB

Download
memory/4076-132-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/4076-199-0x00000000079E0000-0x0000000008008000-memory.dmp

Filesize
6.2MB

Download
memory/4076-204-0x0000000009710000-0x0000000009743000-memory.dmp

Filesize
204KB

Download
memory/4076-141-0x00000000079E0000-0x0000000008008000-memory.dmp

Filesize
6.2MB

Download
memory/4076-150-0x0000000007920000-0x0000000007986000-memory.dmp

Filesize
408KB

Download
memory/4076-146-0x0000000007840000-0x00000000078A6000-memory.dmp

Filesize
408KB

Download
memory/4076-167-0x00000000088C0000-0x0000000008936000-memory.dmp

Filesize
472KB

Download
memory/4076-207-0x000000007EDA0000-0x000000007EDA1000-memory.dmp

Filesize
4KB

Download
memory/4076-211-0x0000000007840000-0x00000000078A6000-memory.dmp

Filesize
408KB

Download
memory/4076-215-0x0000000007920000-0x0000000007986000-memory.dmp

Filesize
408KB

Download
memory/4076-137-0x0000000004D60000-0x0000000004D96000-memory.dmp

Filesize
216KB

Download
memory/4076-174-0x00000000012E0000-0x00000000012E1000-memory.dmp

Filesize
4KB

Download
memory/4076-142-0x00000000075A0000-0x00000000075C2000-memory.dmp

Filesize
136KB

Download
memory/4076-208-0x00000000075A0000-0x00000000075C2000-memory.dmp

Filesize
136KB

Download
memory/4216-200-0x00000000070F0000-0x0000000007718000-memory.dmp

Filesize
6.2MB

Download
memory/4216-203-0x0000000008F70000-0x0000000008FA3000-memory.dmp

Filesize
204KB

Download
memory/4216-206-0x0000000008F70000-0x0000000008FA3000-memory.dmp

Filesize
204KB

Download
memory/4216-140-0x00000000070F0000-0x0000000007718000-memory.dmp

Filesize
6.2MB

Download
memory/4216-151-0x0000000007020000-0x0000000007086000-memory.dmp

Filesize
408KB

Download
memory/4216-176-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/4216-135-0x0000000000F60000-0x0000000000F96000-memory.dmp

Filesize
216KB

Download
memory/4216-143-0x0000000006F10000-0x0000000006F32000-memory.dmp

Filesize
136KB

Download
memory/4216-214-0x0000000006FB0000-0x0000000007016000-memory.dmp

Filesize
408KB

Download
memory/4216-212-0x000000007FB20000-0x000000007FB21000-memory.dmp

Filesize
4KB

Download
memory/4216-145-0x0000000006FB0000-0x0000000007016000-memory.dmp

Filesize
408KB

Download
memory/4216-210-0x0000000006F10000-0x0000000006F32000-memory.dmp

Filesize
136KB

Download
memory/4216-166-0x0000000007F30000-0x0000000007FA6000-memory.dmp

Filesize
472KB

Download
memory/4216-133-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/4216-153-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Filesize
4KB

Download
memory/4216-134-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/4216-154-0x0000000000FC2000-0x0000000000FC3000-memory.dmp

Filesize
4KB

Download
memory/4216-160-0x0000000007AB0000-0x0000000007ACC000-memory.dmp

Filesize
112KB

Download
memory/4216-163-0x0000000007E60000-0x0000000007EAB000-memory.dmp

Filesize
300KB

Download
memory/4216-127-0x0000000000000000-mapping.dmp

Download
memory/4216-156-0x0000000007760000-0x0000000007AB0000-memory.dmp

Filesize
3.3MB

Download