njrat | 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

Analysis

max time kernel
169s
max time network
75s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-10-2022 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
Size

855KB
MD5

6aa1e096f657f2d549e67579d7edb490
SHA1

fe36a9211ef9b8c35697c97addccc94a47223d7c
SHA256

48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250
SHA512

746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc
SSDEEP

3072:15oQcAV8NrucfhvH8GLx99NhCHBd0vqV7S1zWnyzYmLZds2qHhHTYYzy6aWeTaAF:1uW

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

mochakis.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Executes dropped EXE 4 IoCs

Processes:

Trojan.exeTrojan.exeTrojan.exeTrojan.exe

pid process

1916 Trojan.exe
964 Trojan.exe
1576 Trojan.exe
652 Trojan.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

2028 netsh.exe

pid	process
1916	Trojan.exe
964	Trojan.exe
1576	Trojan.exe
652	Trojan.exe

pid	process
2028	netsh.exe

Drops startup file 2 IoCs

Processes:

Trojan.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe

Loads dropped DLL 4 IoCs

Processes:

48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exe

pid process

780 48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
1916 Trojan.exe
964 Trojan.exe
1576 Trojan.exe

pid	process
780	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
1916	Trojan.exe
964	Trojan.exe
1576	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Trojan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exe

description	pid	process	target process
PID 912 set thread context of 960	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 960 set thread context of 852	960	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 852 set thread context of 780	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 1916 set thread context of 964	1916	Trojan.exe	Trojan.exe
PID 964 set thread context of 1576	964	Trojan.exe	Trojan.exe
PID 1576 set thread context of 652	1576	Trojan.exe	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exe

pid	process
852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
1916	Trojan.exe
1916	Trojan.exe
1916	Trojan.exe
1576	Trojan.exe
1576	Trojan.exe
1576	Trojan.exe
652	Trojan.exe
652	Trojan.exe
652	Trojan.exe
652	Trojan.exe
652	Trojan.exe
652	Trojan.exe
652	Trojan.exe
652	Trojan.exe
652	Trojan.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exeTrojan.exeTrojan.exeTrojan.exe

description	pid	process
Token: SeDebugPrivilege	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
Token: SeDebugPrivilege	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
Token: SeDebugPrivilege	1916	Trojan.exe
Token: SeDebugPrivilege	1576	Trojan.exe
Token: SeDebugPrivilege	652	Trojan.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

description	pid	process	target process
PID 912 wrote to memory of 960	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 912 wrote to memory of 960	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 912 wrote to memory of 960	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 912 wrote to memory of 960	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 912 wrote to memory of 960	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 912 wrote to memory of 960	912	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 960 wrote to memory of 852	960	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 960 wrote to memory of 852	960	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 960 wrote to memory of 852	960	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 960 wrote to memory of 852	960	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 960 wrote to memory of 852	960	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 960 wrote to memory of 852	960	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 852 wrote to memory of 780	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 852 wrote to memory of 780	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 852 wrote to memory of 780	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 852 wrote to memory of 780	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 852 wrote to memory of 780	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 852 wrote to memory of 780	852	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
PID 780 wrote to memory of 1916	780	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	Trojan.exe
PID 780 wrote to memory of 1916	780	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	Trojan.exe
PID 780 wrote to memory of 1916	780	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	Trojan.exe
PID 780 wrote to memory of 1916	780	48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe	Trojan.exe
PID 1916 wrote to memory of 964	1916	Trojan.exe	Trojan.exe
PID 1916 wrote to memory of 964	1916	Trojan.exe	Trojan.exe
PID 1916 wrote to memory of 964	1916	Trojan.exe	Trojan.exe
PID 1916 wrote to memory of 964	1916	Trojan.exe	Trojan.exe
PID 1916 wrote to memory of 964	1916	Trojan.exe	Trojan.exe
PID 1916 wrote to memory of 964	1916	Trojan.exe	Trojan.exe
PID 964 wrote to memory of 1576	964	Trojan.exe	Trojan.exe
PID 964 wrote to memory of 1576	964	Trojan.exe	Trojan.exe
PID 964 wrote to memory of 1576	964	Trojan.exe	Trojan.exe
PID 964 wrote to memory of 1576	964	Trojan.exe	Trojan.exe
PID 964 wrote to memory of 1576	964	Trojan.exe	Trojan.exe
PID 964 wrote to memory of 1576	964	Trojan.exe	Trojan.exe
PID 1576 wrote to memory of 652	1576	Trojan.exe	Trojan.exe
PID 1576 wrote to memory of 652	1576	Trojan.exe	Trojan.exe
PID 1576 wrote to memory of 652	1576	Trojan.exe	Trojan.exe
PID 1576 wrote to memory of 652	1576	Trojan.exe	Trojan.exe
PID 1576 wrote to memory of 652	1576	Trojan.exe	Trojan.exe
PID 1576 wrote to memory of 652	1576	Trojan.exe	Trojan.exe
PID 652 wrote to memory of 2028	652	Trojan.exe	netsh.exe
PID 652 wrote to memory of 2028	652	Trojan.exe	netsh.exe
PID 652 wrote to memory of 2028	652	Trojan.exe	netsh.exe
PID 652 wrote to memory of 2028	652	Trojan.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
"C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912

C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960

C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
C:\Users\Admin\AppData\Local\Temp\48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250.exe
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:780

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:964

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
8⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
9⤵
- Modifies Windows Firewall
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe
Filesize
855KB

MD5
6aa1e096f657f2d549e67579d7edb490

SHA1
fe36a9211ef9b8c35697c97addccc94a47223d7c

SHA256
48a8eafd9013ef1d61ce5b61601828f97c602531d9f7621af9bcbd4fffc72250

SHA512
746c7ecce12b54aad4a0de9265690a2e860e4a87fddd1a6200f926d857b09cc9ec36da8be2252b0b9802078cab50db1bf6fd6cc1228851a917cfe159ad986ebc

Download Submit
memory/652-104-0x0000000000408B0E-mapping.dmp

Download
memory/652-121-0x0000000004575000-0x0000000004586000-memory.dmp

Filesize
68KB

Download
memory/652-122-0x0000000004575000-0x0000000004586000-memory.dmp

Filesize
68KB

Download
memory/780-71-0x0000000000408B0E-mapping.dmp

Download
memory/780-70-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/780-73-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/780-75-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/852-115-0x0000000004A25000-0x0000000004A36000-memory.dmp

Filesize
68KB

Download
memory/852-79-0x0000000004A25000-0x0000000004A36000-memory.dmp

Filesize
68KB

Download
memory/852-63-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/852-113-0x0000000004A25000-0x0000000004A36000-memory.dmp

Filesize
68KB

Download
memory/852-68-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/852-66-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/852-64-0x000000000044818E-mapping.dmp

Download
memory/912-116-0x0000000004AA5000-0x0000000004AB6000-memory.dmp

Filesize
68KB

Download
memory/912-78-0x0000000004AA5000-0x0000000004AB6000-memory.dmp

Filesize
68KB

Download
memory/912-56-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/912-112-0x0000000004AA5000-0x0000000004AB6000-memory.dmp

Filesize
68KB

Download
memory/912-55-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/912-54-0x00000000011B0000-0x000000000128C000-memory.dmp

Filesize
880KB

Download
memory/960-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/960-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/960-58-0x000000000040BA82-mapping.dmp

Download
memory/960-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/964-87-0x000000000040BA82-mapping.dmp

Download
memory/1576-95-0x000000000044818E-mapping.dmp

Download
memory/1576-111-0x00000000050A5000-0x00000000050B6000-memory.dmp

Filesize
68KB

Download
memory/1576-114-0x00000000050A5000-0x00000000050B6000-memory.dmp

Filesize
68KB

Download
memory/1916-110-0x0000000004DB5000-0x0000000004DC6000-memory.dmp

Filesize
68KB

Download
memory/1916-83-0x0000000000EA0000-0x0000000000F7C000-memory.dmp

Filesize
880KB

Download
memory/1916-80-0x0000000000000000-mapping.dmp

Download
memory/1916-117-0x0000000004DB5000-0x0000000004DC6000-memory.dmp

Filesize
68KB

Download
memory/2028-118-0x0000000000000000-mapping.dmp

Download