44caliber | 283906c670f0a64dbd5f3ce78354ef08071db8b728c3ee93f55195da68fd7d1c

Analysis

max time kernel
151s
max time network
146s
platform
windows7_x64
resource
win7-20220414-en
submitted
11-07-2022 12:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cryptded_protected.sfx.exe
Size

1.7MB
MD5

8a9c5b9db9e0bca2aa8155197462650c
SHA1

5d2422bff61c219a6f3d2974e99c310eab1657b5
SHA256

283906c670f0a64dbd5f3ce78354ef08071db8b728c3ee93f55195da68fd7d1c
SHA512

81b06cc10d7959dc15648ad255351c128ef097ce2f10bc3eb63dc19f93ceb4cceb9d1adb2e4e8a033818f1aebb6fc72193f5dc61ee74a77f482cb29cac8cebab

Score

10^/10

44caliber njrat evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

44caliber

https://discord.com/api/webhooks/963884131157168128/l7y0A3as75Se94o7XMk4zXPVahSSRfUXKz2j0cONgRgga6ZiO0oAtr3nqCmT9TlwHPnJ

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 4 IoCs

Processes:

Cryptded_protected.exeUmbrella.flv.exeInsidious (2).exesvhost.exe

pid process

1404 Cryptded_protected.exe
2040 Umbrella.flv.exe
1756 Insidious (2).exe
2020 svhost.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1588 netsh.exe

pid	process
1588	netsh.exe

Drops startup file 2 IoCs

Processes:

svhost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbf292fcc15f8937d92f60f5f6be68ce.exe	svhost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbf292fcc15f8937d92f60f5f6be68ce.exe	svhost.exe

Loads dropped DLL 6 IoCs

Processes:

Cryptded_protected.sfx.exeCryptded_protected.exeUmbrella.flv.exe

pid	process
1976	Cryptded_protected.sfx.exe
1976	Cryptded_protected.sfx.exe
1976	Cryptded_protected.sfx.exe
1404	Cryptded_protected.exe
1404	Cryptded_protected.exe
2040	Umbrella.flv.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\cbf292fcc15f8937d92f60f5f6be68ce = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cbf292fcc15f8937d92f60f5f6be68ce = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\" .."	svhost.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 freegeoip.app
4 freegeoip.app
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

svhost.exe

description ioc process

File created C:\autorun.inf svhost.exe
File opened for modification C:\autorun.inf svhost.exe
File created D:\autorun.inf svhost.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

Cryptded_protected.exe

pid process

1404 Cryptded_protected.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
3	freegeoip.app
4	freegeoip.app

description	ioc	process
File created	C:\autorun.inf	svhost.exe
File opened for modification	C:\autorun.inf	svhost.exe
File created	D:\autorun.inf	svhost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Insidious (2).exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Insidious (2).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Insidious (2).exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

968 taskkill.exe

pid	process
968	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Cryptded_protected.exepowershell.exeInsidious (2).exesvhost.exe

pid	process
1404	Cryptded_protected.exe
1916	powershell.exe
1756	Insidious (2).exe
1756	Insidious (2).exe
1756	Insidious (2).exe
1756	Insidious (2).exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe
2020	svhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svhost.exe

pid process

2020 svhost.exe

pid	process
2020	svhost.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

Processes:

powershell.exeInsidious (2).exesvhost.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1756	Insidious (2).exe
Token: SeDebugPrivilege	2020	svhost.exe
Token: SeDebugPrivilege	968	taskkill.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe
Token: 33	2020	svhost.exe
Token: SeIncBasePriorityPrivilege	2020	svhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Cryptded_protected.exe

pid process

1404 Cryptded_protected.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

Cryptded_protected.sfx.exeCryptded_protected.exeUmbrella.flv.exesvhost.exe

description	pid	process	target process
PID 1976 wrote to memory of 1404	1976	Cryptded_protected.sfx.exe	Cryptded_protected.exe
PID 1976 wrote to memory of 1404	1976	Cryptded_protected.sfx.exe	Cryptded_protected.exe
PID 1976 wrote to memory of 1404	1976	Cryptded_protected.sfx.exe	Cryptded_protected.exe
PID 1976 wrote to memory of 1404	1976	Cryptded_protected.sfx.exe	Cryptded_protected.exe
PID 1404 wrote to memory of 2040	1404	Cryptded_protected.exe	Umbrella.flv.exe
PID 1404 wrote to memory of 2040	1404	Cryptded_protected.exe	Umbrella.flv.exe
PID 1404 wrote to memory of 2040	1404	Cryptded_protected.exe	Umbrella.flv.exe
PID 1404 wrote to memory of 2040	1404	Cryptded_protected.exe	Umbrella.flv.exe
PID 1404 wrote to memory of 1756	1404	Cryptded_protected.exe	Insidious (2).exe
PID 1404 wrote to memory of 1756	1404	Cryptded_protected.exe	Insidious (2).exe
PID 1404 wrote to memory of 1756	1404	Cryptded_protected.exe	Insidious (2).exe
PID 1404 wrote to memory of 1756	1404	Cryptded_protected.exe	Insidious (2).exe
PID 1404 wrote to memory of 1916	1404	Cryptded_protected.exe	powershell.exe
PID 1404 wrote to memory of 1916	1404	Cryptded_protected.exe	powershell.exe
PID 1404 wrote to memory of 1916	1404	Cryptded_protected.exe	powershell.exe
PID 1404 wrote to memory of 1916	1404	Cryptded_protected.exe	powershell.exe
PID 2040 wrote to memory of 2020	2040	Umbrella.flv.exe	svhost.exe
PID 2040 wrote to memory of 2020	2040	Umbrella.flv.exe	svhost.exe
PID 2040 wrote to memory of 2020	2040	Umbrella.flv.exe	svhost.exe
PID 2040 wrote to memory of 2020	2040	Umbrella.flv.exe	svhost.exe
PID 2020 wrote to memory of 1588	2020	svhost.exe	netsh.exe
PID 2020 wrote to memory of 1588	2020	svhost.exe	netsh.exe
PID 2020 wrote to memory of 1588	2020	svhost.exe	netsh.exe
PID 2020 wrote to memory of 1588	2020	svhost.exe	netsh.exe
PID 2020 wrote to memory of 968	2020	svhost.exe	taskkill.exe
PID 2020 wrote to memory of 968	2020	svhost.exe	taskkill.exe
PID 2020 wrote to memory of 968	2020	svhost.exe	taskkill.exe
PID 2020 wrote to memory of 968	2020	svhost.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.sfx.exe
"C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.sfx.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe
"C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
"C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Roaming\svhost.exe
"C:\Users\Admin\AppData\Roaming\svhost.exe"
4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
5⤵
- Modifies Windows Firewall
PID:1588

C:\Windows\SysWOW64\taskkill.exe
taskkill /F /IM Exsample.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:968

C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe
"C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe"
3⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $file='C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe';for($i=1;$i -le 600 -and (Test-Path $file -PathType leaf);$i++){Remove-Item $file;Start-Sleep -m 100}
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe
Filesize
1.5MB

MD5
fc24752914e03759c7cc97e560154868

SHA1
9790816345ee7f10a0336f4013864c565c75de89

SHA256
a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44

SHA512
7a7082c640fbcb54a9247848dde589258a7182ff2284c166372465f5d7a76ab3ce89cc7d98bba9fab3a670957655e8fb0337cd7f836cc1f88ccfe6aa980f904e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe
Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Insidious (2).exe
Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
C:\Users\Admin\AppData\Roaming\svhost.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
\??\c:\users\admin\appdata\local\temp\cryptded_protected.exe
Filesize
1.5MB

MD5
fc24752914e03759c7cc97e560154868

SHA1
9790816345ee7f10a0336f4013864c565c75de89

SHA256
a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44

SHA512
7a7082c640fbcb54a9247848dde589258a7182ff2284c166372465f5d7a76ab3ce89cc7d98bba9fab3a670957655e8fb0337cd7f836cc1f88ccfe6aa980f904e

Download Submit
\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe
Filesize
1.5MB

MD5
fc24752914e03759c7cc97e560154868

SHA1
9790816345ee7f10a0336f4013864c565c75de89

SHA256
a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44

SHA512
7a7082c640fbcb54a9247848dde589258a7182ff2284c166372465f5d7a76ab3ce89cc7d98bba9fab3a670957655e8fb0337cd7f836cc1f88ccfe6aa980f904e

Download Submit
\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe
Filesize
1.5MB

MD5
fc24752914e03759c7cc97e560154868

SHA1
9790816345ee7f10a0336f4013864c565c75de89

SHA256
a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44

SHA512
7a7082c640fbcb54a9247848dde589258a7182ff2284c166372465f5d7a76ab3ce89cc7d98bba9fab3a670957655e8fb0337cd7f836cc1f88ccfe6aa980f904e

Download Submit
\Users\Admin\AppData\Local\Temp\Cryptded_protected.exe
Filesize
1.5MB

MD5
fc24752914e03759c7cc97e560154868

SHA1
9790816345ee7f10a0336f4013864c565c75de89

SHA256
a0de3c7f5026e72496e15c3fcb24947aa54e2d615bed91bc8f44fd07a2553b44

SHA512
7a7082c640fbcb54a9247848dde589258a7182ff2284c166372465f5d7a76ab3ce89cc7d98bba9fab3a670957655e8fb0337cd7f836cc1f88ccfe6aa980f904e

Download Submit
\Users\Admin\AppData\Local\Temp\Insidious (2).exe
Filesize
252KB

MD5
d7595446b3398cd3f737047a2ea51e6b

SHA1
3149f2afed1ee0b7b64afcd0ddfe52b982c07983

SHA256
a09ef6e960ea808cfd8d3031957e7d8213b03b8ce37e2cafe905d43965635975

SHA512
dc95b3a9117f1e52e735b316a2828e649a904120c604505d071d70f5fdeba40396f1de8f39292e9651deeed6fcb2447026c63383491b080abb9416839bbcd00c

Download Submit
\Users\Admin\AppData\Local\Temp\Umbrella.flv.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe
Filesize
36KB

MD5
e99f837607cb3c47ea0a29cf3e3243f5

SHA1
c94b04439c4151bdd0482df65699c2e516b2eff2

SHA256
4d92d5b42d93bfadff3454236d10a2ff63bb02dbe0332ea83db215df6ded55bb

SHA512
6b7dbfb18395199ae3416d7aeaf18d4b0d3e1fc0168c09cf4f4ec95a7e451121dbf8ba1e4ed2a95ccdcbb56cf27502648308b7fb7a0e33272bdcb9f2aa55f853

Download Submit
memory/968-90-0x0000000000000000-mapping.dmp

Download
memory/1404-65-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/1404-76-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/1404-64-0x0000000000400000-0x00000000007D5000-memory.dmp

Filesize
3.8MB

Download
memory/1404-60-0x0000000000000000-mapping.dmp

Download
memory/1588-89-0x0000000000000000-mapping.dmp

Download
memory/1756-71-0x0000000000000000-mapping.dmp

Download
memory/1756-80-0x0000000000DD0000-0x0000000000E16000-memory.dmp

Filesize
280KB

Download
memory/1916-75-0x0000000000000000-mapping.dmp

Download
memory/1916-78-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/1916-81-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/1976-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/1976-59-0x0000000003580000-0x0000000003955000-memory.dmp

Filesize
3.8MB

Download
memory/1976-58-0x0000000003580000-0x0000000003955000-memory.dmp

Filesize
3.8MB

Download
memory/2020-83-0x0000000000000000-mapping.dmp

Download
memory/2020-88-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-92-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-79-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download
memory/2040-67-0x0000000000000000-mapping.dmp

Download
memory/2040-87-0x0000000074360000-0x000000007490B000-memory.dmp

Filesize
5.7MB

Download