blacknet | 14490c9c139e9bc984781f8143a571e1f1f140c69a7cd12c34fc0bf20abb0889

Analysis

max time kernel
89s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28-01-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BAA73A9B35BF02D8C56A1286BCD2D714.exe
Size

1.1MB
MD5

baa73a9b35bf02d8c56a1286bcd2d714
SHA1

a179259548f9e81b65126130342f5b076c8b8a77
SHA256

14490c9c139e9bc984781f8143a571e1f1f140c69a7cd12c34fc0bf20abb0889
SHA512

02f75dafbd6cabc107fd681d0cc65991b0a21b16b713fba77db4928e78f1da23474ddb4535f8280dc56186da90e41adc7ad8b10ffde2d0b18ff494273021d644
SSDEEP

12288:DCwHtUz0qTqcXrwV+XinIBLAx9gKupscZ0PpHTzY8QGWlCL8K7XLlq95ZPFdmUG/:DCwHybsV/IOv6scZ0BzUfCz3+zsw8YS

Score

10^/10

blacknet zgrat hacked persistence rat trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

HacKed

http://190.123.44.240

Mutex

BN[]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
true
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1644-956-0x0000000000400000-0x000000000041E000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1644-956-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def

Detect ZGRat V1 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2184-4-0x00000000042D0000-0x000000000436E000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-5-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-6-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-14-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-16-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-12-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-18-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-20-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-10-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-8-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-30-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-34-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-32-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-28-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-36-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-26-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-24-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-22-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-38-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-40-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-46-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-48-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-44-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-54-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-56-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-60-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-62-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-66-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-68-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-64-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-58-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-52-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-50-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1
behavioral1/memory/2184-42-0x00000000042D0000-0x0000000004369000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Drops startup file 2 IoCs

Processes:

WindowsUpdate.exeBAA73A9B35BF02D8C56A1286BCD2D714.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sksewdjj.vbs	WindowsUpdate.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sksewdjj.vbs	BAA73A9B35BF02D8C56A1286BCD2D714.exe

Executes dropped EXE 2 IoCs

Processes:

WindowsUpdate.exeWindowsUpdate.exe

pid	Process
1428	WindowsUpdate.exe
1516	WindowsUpdate.exe

Loads dropped DLL 2 IoCs

Processes:

BAA73A9B35BF02D8C56A1286BCD2D714.exeWindowsUpdate.exe

pid	Process
1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe
1428	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WindowsUpdate.exeBAA73A9B35BF02D8C56A1286BCD2D714.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MyClient\\WindowsUpdate.exe"	WindowsUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BAA73A9B35BF02D8C56A1286BCD2D714.exe"	BAA73A9B35BF02D8C56A1286BCD2D714.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MyClient\\WindowsUpdate.exe"	BAA73A9B35BF02D8C56A1286BCD2D714.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

BAA73A9B35BF02D8C56A1286BCD2D714.exeWindowsUpdate.exe

description	pid	Process	procid_target
PID 2184 set thread context of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 1428 set thread context of 1516	1428	WindowsUpdate.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

BAA73A9B35BF02D8C56A1286BCD2D714.exeWindowsUpdate.exe

pid	Process
1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe
1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe
1516	WindowsUpdate.exe
1516	WindowsUpdate.exe
1516	WindowsUpdate.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

BAA73A9B35BF02D8C56A1286BCD2D714.exeBAA73A9B35BF02D8C56A1286BCD2D714.exeWindowsUpdate.exeWindowsUpdate.exe

description	pid	Process
Token: SeDebugPrivilege	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe
Token: SeDebugPrivilege	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe
Token: SeDebugPrivilege	1428	WindowsUpdate.exe
Token: SeDebugPrivilege	1516	WindowsUpdate.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

BAA73A9B35BF02D8C56A1286BCD2D714.exeWindowsUpdate.exe

pid	Process
1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe
1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe
1516	WindowsUpdate.exe
1516	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

BAA73A9B35BF02D8C56A1286BCD2D714.exeBAA73A9B35BF02D8C56A1286BCD2D714.exeWindowsUpdate.exe

description	pid	Process	procid_target
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 2184 wrote to memory of 1644	2184	BAA73A9B35BF02D8C56A1286BCD2D714.exe	28
PID 1644 wrote to memory of 1428	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe	32
PID 1644 wrote to memory of 1428	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe	32
PID 1644 wrote to memory of 1428	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe	32
PID 1644 wrote to memory of 1428	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe	32
PID 1644 wrote to memory of 1428	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe	32
PID 1644 wrote to memory of 1428	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe	32
PID 1644 wrote to memory of 1428	1644	BAA73A9B35BF02D8C56A1286BCD2D714.exe	32
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33
PID 1428 wrote to memory of 1516	1428	WindowsUpdate.exe	33

C:\Users\Admin\AppData\Local\Temp\BAA73A9B35BF02D8C56A1286BCD2D714.exe
"C:\Users\Admin\AppData\Local\Temp\BAA73A9B35BF02D8C56A1286BCD2D714.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Users\Admin\AppData\Local\Temp\BAA73A9B35BF02D8C56A1286BCD2D714.exe
  C:\Users\Admin\AppData\Local\Temp\BAA73A9B35BF02D8C56A1286BCD2D714.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

Filesize
64KB

MD5
36fe3f3f72527621dc47e2b6acb0eac1

SHA1
c3fa9842ab6eb5bc764d9ca2ca6e05e02517879e

SHA256
bbcf9d4174847d06afd7221ce037e7da5264f390914351ed46a0433a4b67d676

SHA512
c736ab9fb8664ba8e83ebaa25591967224be81a2ac9f40292ceba4d3a60e214314c40357e923a69fd404ec7a7e299dc0d89dd8885fcae513ecd102ca9311ee38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

Filesize
1.1MB

MD5
baa73a9b35bf02d8c56a1286bcd2d714

SHA1
a179259548f9e81b65126130342f5b076c8b8a77

SHA256
14490c9c139e9bc984781f8143a571e1f1f140c69a7cd12c34fc0bf20abb0889

SHA512
02f75dafbd6cabc107fd681d0cc65991b0a21b16b713fba77db4928e78f1da23474ddb4535f8280dc56186da90e41adc7ad8b10ffde2d0b18ff494273021d644

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sksewdjj.vbs

Filesize
83B

MD5
1bda7ff3ab57ee35f078aeb89c17198b

SHA1
dd1837e07192a78e9d21ec4055dc0dcd1ac9937a

SHA256
13abe05c8ea57d6976dd03a9089c744e1e156e54e4a0377580f5be181be94869

SHA512
f70f52ad8a7693318bb7332dd2c9a22f8707994fe77aeb15a5694b93df33960f4dc3806a32e137c7d1544a534816e75c1b7c8fab317bb04e59c1df6d7d028723

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

Filesize
1.1MB

MD5
8630fddbd1a5fcfd554e1c9491a842ba

SHA1
c56c633f080cfc3bab936a961e37b1fe93d9fa6d

SHA256
cea5cc90b812164f5832e7bdbf373ff61881db7d39e139e372ffa02b02646281

SHA512
52593852749e16afcb5cf78892a75d02f7f2c38c8a9067a0696b8e495cba4458bc99bdaf832118a5a9f5a07a1f6d7f9e469e794da78fbeea3d8db69f9515d8b7

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

Filesize
81KB

MD5
8803648b14a44b2bcc8a24c10673c587

SHA1
a2baf42f4561c52c72b4521f2a86b459d012e8fa

SHA256
ff8aa400a1a76be1210e462624e5d7a64fcc3fff48fbc121af8dd38719395ac4

SHA512
6d2de5695eebbff773efd0a085cb40bb7b7c34f0672e9381cdf156d7f304d35d125f580ec374fa4d1f3ba6c354f1a27c68b96afebba0e59df11d3f606c49da0e

Download Submit
memory/1428-968-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/1428-1906-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/1428-967-0x0000000000950000-0x0000000000A78000-memory.dmp

Filesize
1.2MB

Download
memory/1428-1921-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/1428-971-0x0000000004BC0000-0x0000000004C00000-memory.dmp

Filesize
256KB

Download
memory/1428-1905-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1428-1907-0x0000000004BC0000-0x0000000004C00000-memory.dmp

Filesize
256KB

Download
memory/1516-1927-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1516-1928-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1516-1926-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1516-1931-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1516-1930-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1516-1929-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1516-1925-0x0000000074730000-0x0000000074E1E000-memory.dmp

Filesize
6.9MB

Download
memory/1644-992-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1644-957-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/1644-969-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1644-990-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/1644-958-0x0000000004D70000-0x0000000004DB0000-memory.dmp

Filesize
256KB

Download
memory/1644-956-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2184-28-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-40-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-54-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-56-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-60-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-62-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-66-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-68-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-64-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-58-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-52-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-50-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-42-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-937-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2184-939-0x0000000004370000-0x00000000043BC000-memory.dmp

Filesize
304KB

Download
memory/2184-938-0x00000000005A0000-0x00000000005D6000-memory.dmp

Filesize
216KB

Download
memory/2184-940-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2184-941-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Filesize
256KB

Download
memory/2184-952-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download
memory/2184-48-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-46-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-44-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-38-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-22-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-24-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-26-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-36-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-0-0x00000000000A0000-0x00000000001C8000-memory.dmp

Filesize
1.2MB

Download
memory/2184-32-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-34-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-30-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-8-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-10-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-20-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-18-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-12-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-16-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-14-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-6-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-5-0x00000000042D0000-0x0000000004369000-memory.dmp

Filesize
612KB

Download
memory/2184-4-0x00000000042D0000-0x000000000436E000-memory.dmp

Filesize
632KB

Download
memory/2184-3-0x00000000041E0000-0x000000000427E000-memory.dmp

Filesize
632KB

Download
memory/2184-2-0x0000000004A90000-0x0000000004AD0000-memory.dmp

Filesize
256KB

Download
memory/2184-1-0x00000000747B0000-0x0000000074E9E000-memory.dmp

Filesize
6.9MB

Download