babylonrat | 1012f81b764e19da221657cbf5c400063faef8f97d82ccc1c7b1bab0921aa85b

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
Size

1.4MB
MD5

e967e5778bbce368c0786e990cda6417
SHA1

92c06f11f52865d2c05a091d92907cc446b150f3
SHA256

1012f81b764e19da221657cbf5c400063faef8f97d82ccc1c7b1bab0921aa85b
SHA512

098caaec0f9482e2b13d1460d3be95322fa564ff5490fe9c06cee735502edabf95804e9d42504bf3d60557b187ce798fa883e188e0c5307a3f33a291f360d8b5
SSDEEP

24576:rrfP1Tok9Kc87buCPiCH3pSkT4gN38kOW8qdM7o+N4Du7Ec:Pd9KcsbDiCwM4CsBTWMpN4OEc

Score

10^/10

babylonrat persistence trojan

Malware Config

Signatures

Babylon RAT
Babylon RAT is remote access trojan written in C++.
trojan babylonrat

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	client.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	client.exe

Executes dropped EXE 7 IoCs

pid	Process
4440	client.exe
4976	client.exe
4080	client.exe
4656	client.exe
1060	client.exe
2060	client.exe
4896	client.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Microsoft Update = "C:\\ProgramData\\WMP UPDATE\\client.exe"	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Microsoft Update = "C:\\ProgramData\\WMP UPDATE\\client.exe"	client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Microsoft Update = "C:\\ProgramData\\WMP UPDATE\\client.exe"	client.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4440 set thread context of 4080	4440	client.exe	103
PID 4656 set thread context of 2060	4656	client.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4908	powershell.exe
4908	powershell.exe
4440	client.exe
4440	client.exe
2680	powershell.exe
2680	powershell.exe
4656	client.exe
4656	client.exe
4068	powershell.exe
4068	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4080	client.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1564	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
Token: SeDebugPrivilege	1564	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
Token: SeTcbPrivilege	1564	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	4440	client.exe
Token: SeShutdownPrivilege	4080	client.exe
Token: SeDebugPrivilege	4080	client.exe
Token: SeTcbPrivilege	4080	client.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeDebugPrivilege	4656	client.exe
Token: SeShutdownPrivilege	2060	client.exe
Token: SeDebugPrivilege	2060	client.exe
Token: SeTcbPrivilege	2060	client.exe
Token: SeDebugPrivilege	4068	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	client.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 4908	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	96
PID 4528 wrote to memory of 4908	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	96
PID 4528 wrote to memory of 4908	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	96
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 4528 wrote to memory of 1564	4528	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	97
PID 1564 wrote to memory of 4440	1564	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	99
PID 1564 wrote to memory of 4440	1564	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	99
PID 1564 wrote to memory of 4440	1564	e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe	99
PID 4440 wrote to memory of 2680	4440	client.exe	100
PID 4440 wrote to memory of 2680	4440	client.exe	100
PID 4440 wrote to memory of 2680	4440	client.exe	100
PID 4440 wrote to memory of 4976	4440	client.exe	102
PID 4440 wrote to memory of 4976	4440	client.exe	102
PID 4440 wrote to memory of 4976	4440	client.exe	102
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4440 wrote to memory of 4080	4440	client.exe	103
PID 4080 wrote to memory of 4656	4080	client.exe	104
PID 4080 wrote to memory of 4656	4080	client.exe	104
PID 4080 wrote to memory of 4656	4080	client.exe	104
PID 4656 wrote to memory of 4068	4656	client.exe	105
PID 4656 wrote to memory of 4068	4656	client.exe	105
PID 4656 wrote to memory of 4068	4656	client.exe	105
PID 4656 wrote to memory of 1060	4656	client.exe	107
PID 4656 wrote to memory of 1060	4656	client.exe	107
PID 4656 wrote to memory of 1060	4656	client.exe	107
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4656 wrote to memory of 2060	4656	client.exe	108
PID 4080 wrote to memory of 4896	4080	client.exe	109
PID 4080 wrote to memory of 4896	4080	client.exe	109
PID 4080 wrote to memory of 4896	4080	client.exe	109

C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\e967e5778bbce368c0786e990cda6417_JaffaCakes118.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\ProgramData\WMP UPDATE\client.exe
    "C:\ProgramData\WMP UPDATE\client.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4440
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\WMP UPDATE\client.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2680
  - - C:\ProgramData\WMP UPDATE\client.exe
      "C:\ProgramData\WMP UPDATE\client.exe"
      4⤵
      Executes dropped EXE
      PID:4976
  - - C:\ProgramData\WMP UPDATE\client.exe
      "C:\ProgramData\WMP UPDATE\client.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\ProgramData\WMP UPDATE\client.exe
        
        "C:\ProgramData\WMP UPDATE\client.exe" 4080
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4656
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\WMP UPDATE\client.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4068
      - C:\ProgramData\WMP UPDATE\client.exe
        
        "C:\ProgramData\WMP UPDATE\client.exe"
        6⤵
        Executes dropped EXE
        
        PID:1060
      - C:\ProgramData\WMP UPDATE\client.exe
        
        "C:\ProgramData\WMP UPDATE\client.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
    - - C:\ProgramData\WMP UPDATE\client.exe
        
        "C:\ProgramData\WMP UPDATE\client.exe" 4080
        5⤵
        Executes dropped EXE
        
        PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WMP UPDATE\client.exe

Filesize
1.4MB

MD5
e967e5778bbce368c0786e990cda6417

SHA1
92c06f11f52865d2c05a091d92907cc446b150f3

SHA256
1012f81b764e19da221657cbf5c400063faef8f97d82ccc1c7b1bab0921aa85b

SHA512
098caaec0f9482e2b13d1460d3be95322fa564ff5490fe9c06cee735502edabf95804e9d42504bf3d60557b187ce798fa883e188e0c5307a3f33a291f360d8b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\client.exe.log

Filesize
1KB

MD5
17573558c4e714f606f997e5157afaac

SHA1
13e16e9415ceef429aaf124139671ebeca09ed23

SHA256
c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

SHA512
f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
e38cf80ccd733d12acd8ed657fa76a0f

SHA1
580e49e1b482dcf0480cefe6d5bf8f0331732296

SHA256
47996c1354ee704ef75a94ae2217033da52695ca164573023cda951bdec728be

SHA512
ed7056b56d6cd0fd42f9bb716c647ed21f988231aa0817f28be7fceab199a274a479af4e7b77b86ed298b6734b39c2e6714d46bd6bd408d9862a77d97013bc12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
087b82405d6019cefbdf61074e3c3de2

SHA1
b53c28d70356f302a4d01776ab56b5cb36321bd2

SHA256
01389ebef23a56d637038ce5b11c13565c5d990e230a84a4a3e58bf514225a3c

SHA512
8438236f6efa383e0b57287dcd8b87d21d947d059766180608baca166dadc6f7531589102dc0329817d0ab2600f6744e1150ebe24beaa98baed3111e69d48c55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
d16499c37046dbd701f8ae3081b9676a

SHA1
f2de36a308c56ae7786944f9f2d45a8b5c255a84

SHA256
0bc644775aef2f91b2bca481e2b505a40c46041bc3fc127de745108c36858d13

SHA512
39f5208080b16ffff74987aa7fbbd4ef6ce7b773e76fbd793e1184a2b24bd7564149b298d7c8707df5a488aabc1f68eb23f0aba36bf79cb63c1f6e5ca3b59020

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0d1egbo5.ffc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1564-22-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1564-13-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1564-17-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1564-16-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1564-14-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2060-148-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2060-147-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/2680-125-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/2680-121-0x0000000007650000-0x00000000076F3000-memory.dmp

Filesize
652KB

Download
memory/2680-122-0x00000000079C0000-0x00000000079D1000-memory.dmp

Filesize
68KB

Download
memory/2680-111-0x00000000710E0000-0x000000007112C000-memory.dmp

Filesize
304KB

Download
memory/2680-123-0x00000000079F0000-0x0000000007A04000-memory.dmp

Filesize
80KB

Download
memory/2680-84-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/2680-110-0x000000007F280000-0x000000007F290000-memory.dmp

Filesize
64KB

Download
memory/2680-109-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/2680-85-0x0000000004E90000-0x0000000004EA0000-memory.dmp

Filesize
64KB

Download
memory/2680-82-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/2680-97-0x0000000006000000-0x0000000006354000-memory.dmp

Filesize
3.3MB

Download
memory/2680-99-0x0000000006770000-0x00000000067BC000-memory.dmp

Filesize
304KB

Download
memory/4080-178-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-81-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-101-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-100-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-129-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-179-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-105-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-102-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-107-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-87-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-127-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-86-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-126-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4080-78-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4440-29-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4440-73-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4440-83-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4440-74-0x0000000005B00000-0x0000000005B10000-memory.dmp

Filesize
64KB

Download
memory/4528-5-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Filesize
64KB

Download
memory/4528-8-0x0000000005DC0000-0x0000000005DD8000-memory.dmp

Filesize
96KB

Download
memory/4528-0-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4528-18-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4528-12-0x0000000009C30000-0x0000000009D04000-memory.dmp

Filesize
848KB

Download
memory/4528-6-0x0000000005AB0000-0x0000000005ABA000-memory.dmp

Filesize
40KB

Download
memory/4528-3-0x0000000006030000-0x00000000065D4000-memory.dmp

Filesize
5.6MB

Download
memory/4528-2-0x0000000005990000-0x0000000005A2C000-memory.dmp

Filesize
624KB

Download
memory/4528-7-0x0000000005D00000-0x0000000005D56000-memory.dmp

Filesize
344KB

Download
memory/4528-4-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Filesize
584KB

Download
memory/4528-1-0x0000000000EE0000-0x0000000001058000-memory.dmp

Filesize
1.5MB

Download
memory/4528-9-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4528-10-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Filesize
64KB

Download
memory/4528-11-0x0000000007690000-0x00000000077AC000-memory.dmp

Filesize
1.1MB

Download
memory/4656-132-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4656-133-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/4656-108-0x0000000005AA0000-0x0000000005AB0000-memory.dmp

Filesize
64KB

Download
memory/4656-106-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4908-60-0x0000000007410000-0x00000000074B3000-memory.dmp

Filesize
652KB

Download
memory/4908-47-0x000000007FC50000-0x000000007FC60000-memory.dmp

Filesize
64KB

Download
memory/4908-41-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Filesize
408KB

Download
memory/4908-36-0x0000000005CD0000-0x0000000005CF2000-memory.dmp

Filesize
136KB

Download
memory/4908-30-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4908-27-0x0000000005540000-0x0000000005B68000-memory.dmp

Filesize
6.2MB

Download
memory/4908-43-0x0000000005FD0000-0x0000000006324000-memory.dmp

Filesize
3.3MB

Download
memory/4908-44-0x0000000006430000-0x000000000644E000-memory.dmp

Filesize
120KB

Download
memory/4908-28-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4908-45-0x00000000064D0000-0x000000000651C000-memory.dmp

Filesize
304KB

Download
memory/4908-23-0x0000000004E80000-0x0000000004EB6000-memory.dmp

Filesize
216KB

Download
memory/4908-26-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4908-46-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4908-42-0x0000000005F60000-0x0000000005FC6000-memory.dmp

Filesize
408KB

Download
memory/4908-48-0x0000000006A10000-0x0000000006A42000-memory.dmp

Filesize
200KB

Download
memory/4908-49-0x0000000070820000-0x000000007086C000-memory.dmp

Filesize
304KB

Download
memory/4908-59-0x00000000069F0000-0x0000000006A0E000-memory.dmp

Filesize
120KB

Download
memory/4908-62-0x0000000007740000-0x000000000775A000-memory.dmp

Filesize
104KB

Download
memory/4908-61-0x0000000007D80000-0x00000000083FA000-memory.dmp

Filesize
6.5MB

Download
memory/4908-72-0x0000000074E90000-0x0000000075640000-memory.dmp

Filesize
7.7MB

Download
memory/4908-69-0x0000000007A60000-0x0000000007A68000-memory.dmp

Filesize
32KB

Download
memory/4908-68-0x0000000007A80000-0x0000000007A9A000-memory.dmp

Filesize
104KB

Download
memory/4908-67-0x0000000007980000-0x0000000007994000-memory.dmp

Filesize
80KB

Download
memory/4908-66-0x0000000007970000-0x000000000797E000-memory.dmp

Filesize
56KB

Download
memory/4908-65-0x0000000007940000-0x0000000007951000-memory.dmp

Filesize
68KB

Download
memory/4908-64-0x00000000079C0000-0x0000000007A56000-memory.dmp

Filesize
600KB

Download
memory/4908-63-0x00000000077B0000-0x00000000077BA000-memory.dmp

Filesize
40KB

Download