njrat | 62903cdbc89eeadf93d8f7e794af22d4ef9ab0e8178dffce29ee99ea39243717

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2024, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea3b84fad1d89821f40e392cb44a2e20N.exe
Size

65KB
MD5

ea3b84fad1d89821f40e392cb44a2e20
SHA1

0ce9053434d3ddac9c55cb15c87f4644e2b802d5
SHA256

62903cdbc89eeadf93d8f7e794af22d4ef9ab0e8178dffce29ee99ea39243717
SHA512

aba531679daded771669fe0b0bd82cc79d55af9406a98b3863886db2cb71c35af3c4680f45e71365245057377e591cf85868640400361ad43aeae40d0f7904ed
SSDEEP

1536:vB4166DoN36tfQviFw1LsMauQsBnvb6fLteF3nLrB9z3nDaF9b5S9vM:vq166DoN36tfQviFCLX/BnGfWl9zTaFn

Score

10^/10

njrat hacked discovery persistence trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

127.0.0.1:19079

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
|Ghost|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	ea3b84fad1d89821f40e392cb44a2e20N.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.url	ea3b84fad1d89821f40e392cb44a2e20N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe	ea3b84fad1d89821f40e392cb44a2e20N.exe

Executes dropped EXE 1 IoCs

pid	Process
4464	ea3b84fad1d89821f40e392cb44a2e20N.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ea3b84fad1d89821f40e392cb44a2e20N.exe\" .."	ea3b84fad1d89821f40e392cb44a2e20N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ea3b84fad1d89821f40e392cb44a2e20N.exe\" .."	ea3b84fad1d89821f40e392cb44a2e20N.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3b84fad1d89821f40e392cb44a2e20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea3b84fad1d89821f40e392cb44a2e20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TASKKILL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2636	TASKKILL.exe
4108	TASKKILL.exe
1084	TASKKILL.exe
2020	TASKKILL.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
700	schtasks.exe
452	schtasks.exe
1188	schtasks.exe
1760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
1124	ea3b84fad1d89821f40e392cb44a2e20N.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeDebugPrivilege	1084	TASKKILL.exe
Token: SeDebugPrivilege	2020	TASKKILL.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeDebugPrivilege	4464	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeDebugPrivilege	4108	TASKKILL.exe
Token: SeDebugPrivilege	2636	TASKKILL.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: 33	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe
Token: SeIncBasePriorityPrivilege	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 1084	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	84
PID 1124 wrote to memory of 1084	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	84
PID 1124 wrote to memory of 1084	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	84
PID 1124 wrote to memory of 2020	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	85
PID 1124 wrote to memory of 2020	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	85
PID 1124 wrote to memory of 2020	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	85
PID 1124 wrote to memory of 4632	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	100
PID 1124 wrote to memory of 4632	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	100
PID 1124 wrote to memory of 4632	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	100
PID 1124 wrote to memory of 1188	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	102
PID 1124 wrote to memory of 1188	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	102
PID 1124 wrote to memory of 1188	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	102
PID 1124 wrote to memory of 3796	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	107
PID 1124 wrote to memory of 3796	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	107
PID 1124 wrote to memory of 3796	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	107
PID 1124 wrote to memory of 1760	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	109
PID 1124 wrote to memory of 1760	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	109
PID 1124 wrote to memory of 1760	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	109
PID 1124 wrote to memory of 4140	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	112
PID 1124 wrote to memory of 4140	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	112
PID 1124 wrote to memory of 4140	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	112
PID 1124 wrote to memory of 700	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	114
PID 1124 wrote to memory of 700	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	114
PID 1124 wrote to memory of 700	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	114
PID 4464 wrote to memory of 2636	4464	ea3b84fad1d89821f40e392cb44a2e20N.exe	117
PID 4464 wrote to memory of 2636	4464	ea3b84fad1d89821f40e392cb44a2e20N.exe	117
PID 4464 wrote to memory of 2636	4464	ea3b84fad1d89821f40e392cb44a2e20N.exe	117
PID 4464 wrote to memory of 4108	4464	ea3b84fad1d89821f40e392cb44a2e20N.exe	118
PID 4464 wrote to memory of 4108	4464	ea3b84fad1d89821f40e392cb44a2e20N.exe	118
PID 4464 wrote to memory of 4108	4464	ea3b84fad1d89821f40e392cb44a2e20N.exe	118
PID 1124 wrote to memory of 4684	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	121
PID 1124 wrote to memory of 4684	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	121
PID 1124 wrote to memory of 4684	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	121
PID 1124 wrote to memory of 452	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	123
PID 1124 wrote to memory of 452	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	123
PID 1124 wrote to memory of 452	1124	ea3b84fad1d89821f40e392cb44a2e20N.exe	123

C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe
"C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1084
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4632
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1188
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3796
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1760
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4140
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:700
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:452

C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe
C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM wscript.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\SysWOW64\TASKKILL.exe
  TASKKILL /F /IM cmd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ea3b84fad1d89821f40e392cb44a2e20N.exe

Filesize
65KB

MD5
ea3b84fad1d89821f40e392cb44a2e20

SHA1
0ce9053434d3ddac9c55cb15c87f4644e2b802d5

SHA256
62903cdbc89eeadf93d8f7e794af22d4ef9ab0e8178dffce29ee99ea39243717

SHA512
aba531679daded771669fe0b0bd82cc79d55af9406a98b3863886db2cb71c35af3c4680f45e71365245057377e591cf85868640400361ad43aeae40d0f7904ed

Download Submit
memory/1124-0-0x00000000748D2000-0x00000000748D3000-memory.dmp

Filesize
4KB

Download
memory/1124-1-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/1124-2-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/1124-3-0x00000000748D2000-0x00000000748D3000-memory.dmp

Filesize
4KB

Download
memory/1124-4-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/1124-5-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/1124-11-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/1124-12-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/1124-13-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download
memory/1124-14-0x00000000748D0000-0x0000000074E81000-memory.dmp

Filesize
5.7MB

Download