bitrat | a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07

Analysis

max time kernel
150s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
Size

9.7MB
MD5

e0866df50713533e04728b04a5286de9
SHA1

8ea1239123bf01d9c610662b7f511e6dc967dd7f
SHA256

a1e30c275232ebe20659a9541f2a8af8cc1b1a9c46d88c91bd0fc37ca2fb1d07
SHA512

5f0f4b77e6da798cccf7beec865e1b2c964448d45c048d66193c95de93381a561b50f673de8cd8ecc6bc33d672cf9ee57a180fd2edfe26ecaef447babf27c9f9
SSDEEP

196608:SX8+4u9dvKX5onopXD/WVrTm5x6nW40Z5io98N2HBMADiYfNogmNmAiHNv:SX595KX5zpXLKrTLPE0U8o+AD3MmAiHN

Score

10^/10

bitrat discovery evasion trojan

Malware Config

Extracted

Family

bitrat

Version

1.34

logonapplication.ddns.net:4016

Attributes

communication_password
c4ca4238a0b923820dcc509a6f75849b
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

Drops startup file 3 IoCs

Processes:

cmd.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bypass.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Process.exe	cmd.exe

Executes dropped EXE 2 IoCs

Processes:

Bypass.exeDefender.exe

pid process

4004 Bypass.exe
3744 Defender.exe

pid	process
4004	Bypass.exe
3744	Defender.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

MSBuild.exe

pid process

3212 MSBuild.exe
3212 MSBuild.exe
3212 MSBuild.exe
3212 MSBuild.exe

pid	process
3212	MSBuild.exe
3212	MSBuild.exe
3212	MSBuild.exe
3212	MSBuild.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exeMSBuild.exe

description	pid	process	target process
PID 3620 set thread context of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 2400 set thread context of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 set thread context of 3212	2400	MSBuild.exe	MSBuild.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exeschtasks.exeMSBuild.exeMSBuild.exeMSBuild.exeBypass.exeDefender.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bypass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Defender.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

4540 schtasks.exe

pid	process
4540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

pid	process
3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exeMSBuild.exe

description pid process

Token: SeDebugPrivilege 3620 e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
Token: SeShutdownPrivilege 3212 MSBuild.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSBuild.exe

pid process

3212 MSBuild.exe
3212 MSBuild.exe

description	pid	process
Token: SeDebugPrivilege	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
Token: SeShutdownPrivilege	3212	MSBuild.exe

pid	process
3212	MSBuild.exe
3212	MSBuild.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

e0866df50713533e04728b04a5286de9_JaffaCakes118.exeMSBuild.exeMSBuild.execmd.exeBypass.exe

description	pid	process	target process
PID 3620 wrote to memory of 4540	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	schtasks.exe
PID 3620 wrote to memory of 4540	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	schtasks.exe
PID 3620 wrote to memory of 4540	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	schtasks.exe
PID 3620 wrote to memory of 2736	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2736	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2736	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 3620 wrote to memory of 2400	3620	e0866df50713533e04728b04a5286de9_JaffaCakes118.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1088	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1492	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1492	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 1492	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 2400 wrote to memory of 3212	2400	MSBuild.exe	MSBuild.exe
PID 1088 wrote to memory of 3304	1088	MSBuild.exe	cmd.exe
PID 1088 wrote to memory of 3304	1088	MSBuild.exe	cmd.exe
PID 3304 wrote to memory of 4004	3304	cmd.exe	Bypass.exe
PID 3304 wrote to memory of 4004	3304	cmd.exe	Bypass.exe
PID 3304 wrote to memory of 4004	3304	cmd.exe	Bypass.exe
PID 4004 wrote to memory of 3744	4004	Bypass.exe	Defender.exe
PID 4004 wrote to memory of 3744	4004	Bypass.exe	Defender.exe
PID 4004 wrote to memory of 3744	4004	Bypass.exe	Defender.exe

C:\Users\Admin\AppData\Local\Temp\e0866df50713533e04728b04a5286de9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e0866df50713533e04728b04a5286de9_JaffaCakes118.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uskPBklHAI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92E0.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\98AC.tmp\98AD.tmp\98AE.bat C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Drops startup file
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\98AC.tmp\Bypass.exe
        
        Bypass.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Defender.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Defender.exe" /D
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3744
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1492
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:8
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\98AC.tmp\98AD.tmp\98AE.bat

Filesize
525B

MD5
d4a739ca802d5dff563766977640f58e

SHA1
0a0c28f80cdedb2ecac1d76d15e38b60a63b2be5

SHA256
17e4ba6c84d45d5228b96a9a28292e658212c41b8764df0b6510cad24926d6f5

SHA512
15de091c5da6fd765e77f23169ce0cbf5b6d045d784cea28f688afe21a96a686fb9995acb2ea8394753a1024c27e4d31d8753ba86d18f880b8009ee001b24004

Download Submit
C:\Users\Admin\AppData\Local\Temp\98AC.tmp\Bypass.exe

Filesize
810KB

MD5
8ec8ca109abce872ef8e54a7c6af215f

SHA1
3b4b130d9fdeef5a41a740ea52bf121f24aab713

SHA256
5f556b89361ab895a2fc24da90323a2ca43ad1dd46a644b128caeb2879eb411d

SHA512
04b3e1457ca6c4ab85d1622a4650e24516af597cb009d9f3681008d72c15e6a9ef626ce4d1e9d52aa6df176836079c6fe6f3d62716afe23c6409871beccc18a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\98AC.tmp\Microsoft Edge.exe

Filesize
4.9MB

MD5
5b72bdd9ce48384dd0ba54da5f7f25b7

SHA1
7d0e7082e80632ef6bf215190fceccc9cc4e8557

SHA256
d595638f180e98368cf12e9499d22f05dbb7ce4fb8bebfd51dc3ea723b7bd372

SHA512
42f6ebd4dd4c9b2c6abbdf5b7c6822e1845dd44a198300f3470ff7518b129548c1c4fa10e3570157ed61654ec4e741ae6e76cdc18633129d4adcb5c26ee42f1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Defender.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp92E0.tmp

Filesize
1KB

MD5
87c351a5f1047480cbc4fce9b5d1daab

SHA1
aa596cf75b7775ed8e0a261db9727ca188414936

SHA256
a432d2f78655dc3ac3cf2e260b14d9d9e333eb035f0071d77b15a7c57fa516b6

SHA512
046e29d18232c0a176a66f7ace1e301040fe079a55fca815b97885744079e70047ff1f981f33a4d91c01aca186b34d4d309a6dc454a3c2cd3e468d3b133cf474

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Process.exe

Filesize
90KB

MD5
6a29526673cdfdc28f9ea288165a03ca

SHA1
596e37d7be4d7e961333df360f6589ee8c881027

SHA256
2ed4ff8edef9e91278a876937ec2cd516ef6313ea5ce8cadb8d8a667933fc829

SHA512
c3bc6761ab503c3fbe9cb9cb344a2a81f750585f738febc9528278ee08e8654dde29f46aa0fb2537c107a28ac6de00e1f34410a9458c07413dc01b2fa88bb695

Download Submit
memory/1088-84-0x0000000000400000-0x000000000096B000-memory.dmp

Filesize
5.4MB

Download
memory/1088-26-0x0000000000400000-0x000000000096B000-memory.dmp

Filesize
5.4MB

Download
memory/1088-30-0x0000000000400000-0x000000000096B000-memory.dmp

Filesize
5.4MB

Download
memory/1088-24-0x0000000000400000-0x000000000096B000-memory.dmp

Filesize
5.4MB

Download
memory/2400-18-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/2400-33-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/2400-19-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/2400-22-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/2400-20-0x0000000000400000-0x0000000000D6A000-memory.dmp

Filesize
9.4MB

Download
memory/3212-28-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-94-0x0000000074D70000-0x0000000074DA9000-memory.dmp

Filesize
228KB

Download
memory/3212-100-0x0000000074D70000-0x0000000074DA9000-memory.dmp

Filesize
228KB

Download
memory/3212-98-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-99-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-27-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-29-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-97-0x0000000074D70000-0x0000000074DA9000-memory.dmp

Filesize
228KB

Download
memory/3212-31-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-96-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-95-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-86-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-41-0x0000000073E60000-0x0000000073E99000-memory.dmp

Filesize
228KB

Download
memory/3212-42-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-48-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-49-0x00000000733F0000-0x0000000073429000-memory.dmp

Filesize
228KB

Download
memory/3212-93-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-92-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-91-0x0000000074D70000-0x0000000074DA9000-memory.dmp

Filesize
228KB

Download
memory/3212-90-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-89-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-88-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3212-87-0x0000000074D70000-0x0000000074DA9000-memory.dmp

Filesize
228KB

Download
memory/3212-85-0x0000000000400000-0x00000000007CD000-memory.dmp

Filesize
3.8MB

Download
memory/3620-0-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/3620-7-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/3620-2-0x00000000052E0000-0x000000000537C000-memory.dmp

Filesize
624KB

Download
memory/3620-3-0x0000000005930000-0x0000000005ED4000-memory.dmp

Filesize
5.6MB

Download
memory/3620-4-0x0000000005420000-0x00000000054B2000-memory.dmp

Filesize
584KB

Download
memory/3620-12-0x00000000058B0000-0x0000000005916000-memory.dmp

Filesize
408KB

Download
memory/3620-5-0x00000000053A0000-0x00000000053AA000-memory.dmp

Filesize
40KB

Download
memory/3620-1-0x00000000000C0000-0x0000000000A86000-memory.dmp

Filesize
9.8MB

Download
memory/3620-6-0x0000000005610000-0x0000000005666000-memory.dmp

Filesize
344KB

Download
memory/3620-23-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/3620-8-0x0000000005410000-0x000000000541A000-memory.dmp

Filesize
40KB

Download
memory/3620-9-0x00000000744BE000-0x00000000744BF000-memory.dmp

Filesize
4KB

Download
memory/3620-10-0x00000000744B0000-0x0000000074C60000-memory.dmp

Filesize
7.7MB

Download
memory/3620-11-0x000000000D890000-0x000000000E22A000-memory.dmp

Filesize
9.6MB

Download
memory/4004-54-0x0000000000B40000-0x0000000000C10000-memory.dmp

Filesize
832KB

Download