webmonitor | 19fddcec9add9da51ecd1e3662e55f8c8ddf9973a8babb6ecfc1df8a02c63afa

Analysis

max time kernel
151s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
05-02-2022 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMAGE20210406_490133692.exe
Size

1.6MB
MD5

432494553bb7b05ce1970f180968aac3
SHA1

c1147f87babcf9c0ce3e278ded158c1343dc7e92
SHA256

ecf20ba9055ef6e87d3c8565f3eedf67f02b068c844056d7a5c1d60bb9e67e5b
SHA512

bf961ad8680d045a9a2555018695ed2e0a607feda2b60a3936be19f380985742075349d3d9112a8894f5a0c0fef2c9c668e5469ca4005ca7109bf8925b5067fd

Score

10^/10

webmonitor backdoor infostealer rat

Malware Config

Extracted

Family

webmonitor

saudi101.wm01.to:443

Attributes

config_key
lTAZJgwyYrKf0HlGbBwDnSIl6MwJkb96
private_key
R048cDPMf
url_path
/recv5.php

Signatures

RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
backdoor rat infostealer webmonitor

WebMonitor Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1280-152-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor
behavioral2/memory/1280-155-0x0000000000400000-0x00000000004F3000-memory.dmp	family_webmonitor

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	IMAGE20210406_490133692.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	IMAGE20210406_490133692.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1568 set thread context of 1280	1568	IMAGE20210406_490133692.exe	74

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2644	schtasks.exe

Modifies data under HKEY_USERS 51 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.918218"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132887185488187035"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3856"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "90228624"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.013108"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "4"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "1157726"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4044"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1568	IMAGE20210406_490133692.exe
1568	IMAGE20210406_490133692.exe
1568	IMAGE20210406_490133692.exe
1320	powershell.exe
1384	powershell.exe
1568	IMAGE20210406_490133692.exe
1964	powershell.exe
1320	powershell.exe
1384	powershell.exe
1964	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1280	IMAGE20210406_490133692.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	IMAGE20210406_490133692.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeShutdownPrivilege	1280	IMAGE20210406_490133692.exe
Token: SeCreatePagefilePrivilege	1280	IMAGE20210406_490133692.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 1384	1568	IMAGE20210406_490133692.exe	68
PID 1568 wrote to memory of 1384	1568	IMAGE20210406_490133692.exe	68
PID 1568 wrote to memory of 1384	1568	IMAGE20210406_490133692.exe	68
PID 1568 wrote to memory of 1320	1568	IMAGE20210406_490133692.exe	70
PID 1568 wrote to memory of 1320	1568	IMAGE20210406_490133692.exe	70
PID 1568 wrote to memory of 1320	1568	IMAGE20210406_490133692.exe	70
PID 1568 wrote to memory of 2644	1568	IMAGE20210406_490133692.exe	72
PID 1568 wrote to memory of 2644	1568	IMAGE20210406_490133692.exe	72
PID 1568 wrote to memory of 2644	1568	IMAGE20210406_490133692.exe	72
PID 1568 wrote to memory of 1964	1568	IMAGE20210406_490133692.exe	75
PID 1568 wrote to memory of 1964	1568	IMAGE20210406_490133692.exe	75
PID 1568 wrote to memory of 1964	1568	IMAGE20210406_490133692.exe	75
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1568 wrote to memory of 1280	1568	IMAGE20210406_490133692.exe	74
PID 1280 wrote to memory of 3168	1280	IMAGE20210406_490133692.exe	78
PID 1280 wrote to memory of 3168	1280	IMAGE20210406_490133692.exe	78
PID 1280 wrote to memory of 3168	1280	IMAGE20210406_490133692.exe	78

C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
"C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nTLvOJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A11.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe
  "C:\Users\Admin\AppData\Local\Temp\IMAGE20210406_490133692.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AX2LT6Z2it8SYkbu.bat" "
    3⤵
    PID:3168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nTLvOJ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-155-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1280-152-0x0000000000400000-0x00000000004F3000-memory.dmp

Filesize
972KB

Download
memory/1320-150-0x00000000076E0000-0x0000000007746000-memory.dmp

Filesize
408KB

Download
memory/1320-151-0x0000000007FC0000-0x0000000008026000-memory.dmp

Filesize
408KB

Download
memory/1320-165-0x00000000752E0000-0x000000007532C000-memory.dmp

Filesize
304KB

Download
memory/1320-175-0x0000000009BE0000-0x0000000009BFA000-memory.dmp

Filesize
104KB

Download
memory/1320-161-0x0000000007355000-0x0000000007357000-memory.dmp

Filesize
8KB

Download
memory/1320-158-0x0000000008570000-0x000000000858E000-memory.dmp

Filesize
120KB

Download
memory/1320-169-0x000000007F960000-0x000000007F961000-memory.dmp

Filesize
4KB

Download
memory/1320-146-0x0000000007350000-0x0000000007351000-memory.dmp

Filesize
4KB

Download
memory/1320-147-0x0000000007352000-0x0000000007353000-memory.dmp

Filesize
4KB

Download
memory/1320-149-0x00000000074C0000-0x00000000074E2000-memory.dmp

Filesize
136KB

Download
memory/1384-174-0x0000000008FF0000-0x0000000008FFE000-memory.dmp

Filesize
56KB

Download
memory/1384-140-0x0000000004180000-0x00000000041B6000-memory.dmp

Filesize
216KB

Download
memory/1384-159-0x00000000041C5000-0x00000000041C7000-memory.dmp

Filesize
8KB

Download
memory/1384-143-0x0000000006D80000-0x00000000073A8000-memory.dmp

Filesize
6.2MB

Download
memory/1384-168-0x000000007EE30000-0x000000007EE31000-memory.dmp

Filesize
4KB

Download
memory/1384-173-0x0000000009030000-0x00000000090C6000-memory.dmp

Filesize
600KB

Download
memory/1384-163-0x00000000752E0000-0x000000007532C000-memory.dmp

Filesize
304KB

Download
memory/1384-144-0x00000000041C0000-0x00000000041C1000-memory.dmp

Filesize
4KB

Download
memory/1384-170-0x0000000009400000-0x0000000009A7A000-memory.dmp

Filesize
6.5MB

Download
memory/1384-145-0x00000000041C2000-0x00000000041C3000-memory.dmp

Filesize
4KB

Download
memory/1568-134-0x0000000005970000-0x0000000005F14000-memory.dmp

Filesize
5.6MB

Download
memory/1568-136-0x0000000005BC0000-0x0000000005C16000-memory.dmp

Filesize
344KB

Download
memory/1568-135-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/1568-137-0x000000007FDA0000-0x000000007FDA1000-memory.dmp

Filesize
4KB

Download
memory/1568-132-0x0000000005F20000-0x00000000064C4000-memory.dmp

Filesize
5.6MB

Download
memory/1568-130-0x0000000000D50000-0x0000000000EE6000-memory.dmp

Filesize
1.6MB

Download
memory/1568-133-0x0000000005970000-0x0000000005A02000-memory.dmp

Filesize
584KB

Download
memory/1568-131-0x00000000058D0000-0x000000000596C000-memory.dmp

Filesize
624KB

Download
memory/1964-157-0x0000000006DF2000-0x0000000006DF3000-memory.dmp

Filesize
4KB

Download
memory/1964-171-0x00000000095C0000-0x00000000095DA000-memory.dmp

Filesize
104KB

Download
memory/1964-167-0x000000007FAA0000-0x000000007FAA1000-memory.dmp

Filesize
4KB

Download
memory/1964-172-0x0000000009630000-0x000000000963A000-memory.dmp

Filesize
40KB

Download
memory/1964-166-0x00000000087C0000-0x00000000087DE000-memory.dmp

Filesize
120KB

Download
memory/1964-164-0x00000000752E0000-0x000000007532C000-memory.dmp

Filesize
304KB

Download
memory/1964-162-0x00000000087E0000-0x0000000008812000-memory.dmp

Filesize
200KB

Download
memory/1964-176-0x00000000098E0000-0x00000000098E8000-memory.dmp

Filesize
32KB

Download
memory/1964-160-0x0000000006DF5000-0x0000000006DF7000-memory.dmp

Filesize
8KB

Download
memory/1964-156-0x0000000006DF0000-0x0000000006DF1000-memory.dmp

Filesize
4KB

Download