bitrat | c06cab989e964346467e4190f382ebc1777ef20786ac7f190ae080b8422f2d88

Analysis

max time kernel
147s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-09-2022 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20_89_27.exe
Size

9.4MB
MD5

0894f84db87ca8148cd35781341489a2
SHA1

de5b88287a6454115d06de0d555e94820c3791c8
SHA256

c06cab989e964346467e4190f382ebc1777ef20786ac7f190ae080b8422f2d88
SHA512

00579a26b5640deae733df142f3e86a4b62c9a52828256d7ce165ad8ac7ffb2233a8e1f9a96268e3391e0ebcabb136e62633660881b8dbafc410b7531731566c
SSDEEP

49152:aJJKPuu28T4Vlp50dmHwWrwIdECy8AmY+VG9hk:1uu2r950873yr

Score

10^/10

bitrat njrat may4000 trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

bit9090.duckdns.org:9090

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
tor_process
tor

Extracted

Family

njrat

Version

v2.0

Botnet

May4000

dan4000.duckdns.org:4000

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 3 IoCs

Processes:

dan4000new.exeHJGGJHG.exeHJGGJHG.exe

pid process

772 dan4000new.exe
1208 HJGGJHG.exe
1424 HJGGJHG.exe

pid	process
772	dan4000new.exe
1208	HJGGJHG.exe
1424	HJGGJHG.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1316-60-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-62-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-63-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-66-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-65-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-69-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-70-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-76-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1316-85-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2004-101-0x0000000000470000-0x0000000000854000-memory.dmp	upx
behavioral1/memory/2004-98-0x0000000000470000-0x0000000000854000-memory.dmp	upx
behavioral1/memory/2004-97-0x0000000000470000-0x0000000000854000-memory.dmp	upx
behavioral1/memory/2004-103-0x0000000000470000-0x0000000000854000-memory.dmp	upx
behavioral1/memory/2004-104-0x0000000000470000-0x0000000000854000-memory.dmp	upx
behavioral1/memory/2000-123-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/2000-124-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

dan4000new.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk dan4000new.exe
Loads dropped DLL 1 IoCs

Processes:

20_89_27.exe

pid process

1048 20_89_27.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

RegAsm.exeRegAsm.exeRegAsm.exe

pid process

1316 RegAsm.exe
1316 RegAsm.exe
1316 RegAsm.exe
1316 RegAsm.exe
1316 RegAsm.exe
2004 RegAsm.exe
2000 RegAsm.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	dan4000new.exe

pid	process
1048	20_89_27.exe

pid	process
1316	RegAsm.exe
1316	RegAsm.exe
1316	RegAsm.exe
1316	RegAsm.exe
1316	RegAsm.exe
2004	RegAsm.exe
2000	RegAsm.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

20_89_27.exeHJGGJHG.exeHJGGJHG.exe

description	pid	process	target process
PID 1048 set thread context of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1208 set thread context of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1424 set thread context of 2000	1424	HJGGJHG.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

980 schtasks.exe
368 schtasks.exe
1356 schtasks.exe

pid	process
980	schtasks.exe
368	schtasks.exe
1356	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

RegAsm.exedan4000new.exeRegAsm.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1316	RegAsm.exe
Token: SeShutdownPrivilege	1316	RegAsm.exe
Token: SeDebugPrivilege	772	dan4000new.exe
Token: 33	772	dan4000new.exe
Token: SeIncBasePriorityPrivilege	772	dan4000new.exe
Token: 33	772	dan4000new.exe
Token: SeIncBasePriorityPrivilege	772	dan4000new.exe
Token: SeDebugPrivilege	2004	RegAsm.exe
Token: SeShutdownPrivilege	2004	RegAsm.exe
Token: 33	772	dan4000new.exe
Token: SeIncBasePriorityPrivilege	772	dan4000new.exe
Token: 33	772	dan4000new.exe
Token: SeIncBasePriorityPrivilege	772	dan4000new.exe
Token: 33	772	dan4000new.exe
Token: SeIncBasePriorityPrivilege	772	dan4000new.exe
Token: 33	772	dan4000new.exe
Token: SeIncBasePriorityPrivilege	772	dan4000new.exe
Token: SeDebugPrivilege	2000	RegAsm.exe
Token: SeShutdownPrivilege	2000	RegAsm.exe
Token: 33	772	dan4000new.exe
Token: SeIncBasePriorityPrivilege	772	dan4000new.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

RegAsm.exe

pid process

1316 RegAsm.exe
1316 RegAsm.exe

pid	process
1316	RegAsm.exe
1316	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

20_89_27.execmd.exetaskeng.exeHJGGJHG.execmd.exeHJGGJHG.execmd.exe

description	pid	process	target process
PID 1048 wrote to memory of 1508	1048	20_89_27.exe	cmd.exe
PID 1048 wrote to memory of 1508	1048	20_89_27.exe	cmd.exe
PID 1048 wrote to memory of 1508	1048	20_89_27.exe	cmd.exe
PID 1048 wrote to memory of 1508	1048	20_89_27.exe	cmd.exe
PID 1508 wrote to memory of 1356	1508	cmd.exe	schtasks.exe
PID 1508 wrote to memory of 1356	1508	cmd.exe	schtasks.exe
PID 1508 wrote to memory of 1356	1508	cmd.exe	schtasks.exe
PID 1508 wrote to memory of 1356	1508	cmd.exe	schtasks.exe
PID 1048 wrote to memory of 1424	1048	20_89_27.exe	cmd.exe
PID 1048 wrote to memory of 1424	1048	20_89_27.exe	cmd.exe
PID 1048 wrote to memory of 1424	1048	20_89_27.exe	cmd.exe
PID 1048 wrote to memory of 1424	1048	20_89_27.exe	cmd.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 1316	1048	20_89_27.exe	RegAsm.exe
PID 1048 wrote to memory of 772	1048	20_89_27.exe	dan4000new.exe
PID 1048 wrote to memory of 772	1048	20_89_27.exe	dan4000new.exe
PID 1048 wrote to memory of 772	1048	20_89_27.exe	dan4000new.exe
PID 1048 wrote to memory of 772	1048	20_89_27.exe	dan4000new.exe
PID 1604 wrote to memory of 1208	1604	taskeng.exe	HJGGJHG.exe
PID 1604 wrote to memory of 1208	1604	taskeng.exe	HJGGJHG.exe
PID 1604 wrote to memory of 1208	1604	taskeng.exe	HJGGJHG.exe
PID 1604 wrote to memory of 1208	1604	taskeng.exe	HJGGJHG.exe
PID 1208 wrote to memory of 1568	1208	HJGGJHG.exe	cmd.exe
PID 1208 wrote to memory of 1568	1208	HJGGJHG.exe	cmd.exe
PID 1208 wrote to memory of 1568	1208	HJGGJHG.exe	cmd.exe
PID 1208 wrote to memory of 1568	1208	HJGGJHG.exe	cmd.exe
PID 1208 wrote to memory of 924	1208	HJGGJHG.exe	cmd.exe
PID 1208 wrote to memory of 924	1208	HJGGJHG.exe	cmd.exe
PID 1208 wrote to memory of 924	1208	HJGGJHG.exe	cmd.exe
PID 1208 wrote to memory of 924	1208	HJGGJHG.exe	cmd.exe
PID 1568 wrote to memory of 980	1568	cmd.exe	schtasks.exe
PID 1568 wrote to memory of 980	1568	cmd.exe	schtasks.exe
PID 1568 wrote to memory of 980	1568	cmd.exe	schtasks.exe
PID 1568 wrote to memory of 980	1568	cmd.exe	schtasks.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1208 wrote to memory of 2004	1208	HJGGJHG.exe	RegAsm.exe
PID 1604 wrote to memory of 1424	1604	taskeng.exe	HJGGJHG.exe
PID 1604 wrote to memory of 1424	1604	taskeng.exe	HJGGJHG.exe
PID 1604 wrote to memory of 1424	1604	taskeng.exe	HJGGJHG.exe
PID 1604 wrote to memory of 1424	1604	taskeng.exe	HJGGJHG.exe
PID 1424 wrote to memory of 1284	1424	HJGGJHG.exe	cmd.exe
PID 1424 wrote to memory of 1284	1424	HJGGJHG.exe	cmd.exe
PID 1424 wrote to memory of 1284	1424	HJGGJHG.exe	cmd.exe
PID 1424 wrote to memory of 1284	1424	HJGGJHG.exe	cmd.exe
PID 1284 wrote to memory of 368	1284	cmd.exe	schtasks.exe
PID 1284 wrote to memory of 368	1284	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\20_89_27.exe
"C:\Users\Admin\AppData\Local\Temp\20_89_27.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\HJGGJHG.exe'" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\HJGGJHG.exe'" /f
3⤵
- Creates scheduled task(s)
PID:1356

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\20_89_27.exe" "C:\Users\Admin\AppData\Roaming\HJGGJHG.exe"
2⤵
PID:1424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1316

C:\Users\Admin\AppData\Local\Temp\dan4000new.exe
"C:\Users\Admin\AppData\Local\Temp\dan4000new.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\system32\taskeng.exe
taskeng.exe {0039E18C-9650-4305-9FA2-D1BB38F144D9} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Admin\AppData\Roaming\HJGGJHG.exe
C:\Users\Admin\AppData\Roaming\HJGGJHG.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\HJGGJHG.exe'" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\HJGGJHG.exe'" /f
4⤵
- Creates scheduled task(s)
PID:980

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\HJGGJHG.exe" "C:\Users\Admin\AppData\Roaming\HJGGJHG.exe"
3⤵
PID:924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2004

C:\Users\Admin\AppData\Roaming\HJGGJHG.exe
C:\Users\Admin\AppData\Roaming\HJGGJHG.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\cmd.exe
"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\HJGGJHG.exe'" /f
3⤵
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\HJGGJHG.exe'" /f
4⤵
- Creates scheduled task(s)
PID:368

C:\Windows\SysWOW64\cmd.exe
"cmd" /c copy "C:\Users\Admin\AppData\Roaming\HJGGJHG.exe" "C:\Users\Admin\AppData\Roaming\HJGGJHG.exe"
3⤵
PID:1540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dan4000new.exe

Filesize
27KB

MD5
3a523f042269c18d7ee4ab65970c765b

SHA1
3dc6182faa831f570beb8445f20f76e2e1f27827

SHA256
c7dcb35fe7258ccbebe3b42065a24813c0a012a26fdd3990627114687ca3d3b3

SHA512
08f1af47db96836452624f032cd59d7b435ef86a7ca45284a3948a23a37401df6a96cdc599a805098a35c7f8c5719a077d180c778d82127521b9f31f02ed9add

Download Submit
C:\Users\Admin\AppData\Local\Temp\dan4000new.exe

Filesize
27KB

MD5
3a523f042269c18d7ee4ab65970c765b

SHA1
3dc6182faa831f570beb8445f20f76e2e1f27827

SHA256
c7dcb35fe7258ccbebe3b42065a24813c0a012a26fdd3990627114687ca3d3b3

SHA512
08f1af47db96836452624f032cd59d7b435ef86a7ca45284a3948a23a37401df6a96cdc599a805098a35c7f8c5719a077d180c778d82127521b9f31f02ed9add

Download Submit
C:\Users\Admin\AppData\Roaming\HJGGJHG.exe

Filesize
9.4MB

MD5
0894f84db87ca8148cd35781341489a2

SHA1
de5b88287a6454115d06de0d555e94820c3791c8

SHA256
c06cab989e964346467e4190f382ebc1777ef20786ac7f190ae080b8422f2d88

SHA512
00579a26b5640deae733df142f3e86a4b62c9a52828256d7ce165ad8ac7ffb2233a8e1f9a96268e3391e0ebcabb136e62633660881b8dbafc410b7531731566c

Download Submit
C:\Users\Admin\AppData\Roaming\HJGGJHG.exe

Filesize
9.4MB

MD5
0894f84db87ca8148cd35781341489a2

SHA1
de5b88287a6454115d06de0d555e94820c3791c8

SHA256
c06cab989e964346467e4190f382ebc1777ef20786ac7f190ae080b8422f2d88

SHA512
00579a26b5640deae733df142f3e86a4b62c9a52828256d7ce165ad8ac7ffb2233a8e1f9a96268e3391e0ebcabb136e62633660881b8dbafc410b7531731566c

Download Submit
C:\Users\Admin\AppData\Roaming\HJGGJHG.exe

Filesize
9.4MB

MD5
0894f84db87ca8148cd35781341489a2

SHA1
de5b88287a6454115d06de0d555e94820c3791c8

SHA256
c06cab989e964346467e4190f382ebc1777ef20786ac7f190ae080b8422f2d88

SHA512
00579a26b5640deae733df142f3e86a4b62c9a52828256d7ce165ad8ac7ffb2233a8e1f9a96268e3391e0ebcabb136e62633660881b8dbafc410b7531731566c

Download Submit
\Users\Admin\AppData\Local\Temp\dan4000new.exe

Filesize
27KB

MD5
3a523f042269c18d7ee4ab65970c765b

SHA1
3dc6182faa831f570beb8445f20f76e2e1f27827

SHA256
c7dcb35fe7258ccbebe3b42065a24813c0a012a26fdd3990627114687ca3d3b3

SHA512
08f1af47db96836452624f032cd59d7b435ef86a7ca45284a3948a23a37401df6a96cdc599a805098a35c7f8c5719a077d180c778d82127521b9f31f02ed9add

Download Submit
memory/368-109-0x0000000000000000-mapping.dmp

Download
memory/772-86-0x0000000073A40000-0x0000000073FEB000-memory.dmp

Filesize
5.7MB

Download
memory/772-77-0x0000000073A40000-0x0000000073FEB000-memory.dmp

Filesize
5.7MB

Download
memory/772-72-0x0000000000000000-mapping.dmp

Download
memory/924-89-0x0000000000000000-mapping.dmp

Download
memory/980-90-0x0000000000000000-mapping.dmp

Download
memory/1048-54-0x00000000002B0000-0x000000000044A000-memory.dmp

Filesize
1.6MB

Download
memory/1048-55-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1208-81-0x0000000000F40000-0x00000000010DA000-memory.dmp

Filesize
1.6MB

Download
memory/1208-79-0x0000000000000000-mapping.dmp

Download
memory/1284-108-0x0000000000000000-mapping.dmp

Download
memory/1316-65-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-83-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1316-70-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-69-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-66-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-64-0x00000000007E2730-mapping.dmp

Download
memory/1316-63-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-76-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-84-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1316-85-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-62-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-87-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/1316-59-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1316-60-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1356-57-0x0000000000000000-mapping.dmp

Download
memory/1424-58-0x0000000000000000-mapping.dmp

Download
memory/1424-105-0x0000000000000000-mapping.dmp

Download
memory/1508-56-0x0000000000000000-mapping.dmp

Download
memory/1540-110-0x0000000000000000-mapping.dmp

Download
memory/1568-88-0x0000000000000000-mapping.dmp

Download
memory/2000-124-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2000-123-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2000-116-0x00000000007E2730-mapping.dmp

Download
memory/2004-97-0x0000000000470000-0x0000000000854000-memory.dmp

Filesize
3.9MB

Download
memory/2004-92-0x00000000006E2000-0x0000000000853000-memory.dmp

Filesize
1.4MB

Download
memory/2004-104-0x0000000000470000-0x0000000000854000-memory.dmp

Filesize
3.9MB

Download
memory/2004-103-0x0000000000470000-0x0000000000854000-memory.dmp

Filesize
3.9MB

Download
memory/2004-96-0x00000000007E2730-mapping.dmp

Download
memory/2004-98-0x0000000000470000-0x0000000000854000-memory.dmp

Filesize
3.9MB

Download
memory/2004-101-0x0000000000470000-0x0000000000854000-memory.dmp

Filesize
3.9MB

Download