warzonerat | 7c226fda60b190a13b95e0e5e992506ec7214ef9789e2117b4ee11981dad3158

Analysis

max time kernel
150s
max time network
130s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
Size

440KB
MD5

5e87783b71d535bcaf402e2278c91048
SHA1

7e7faec34ecbe87ec3d18a402ff2e71fe3dcb533
SHA256

7c226fda60b190a13b95e0e5e992506ec7214ef9789e2117b4ee11981dad3158
SHA512

f1851e0d8fdcaeb22c3405b2bd23d9397e92fa367bc6576b8f0f200458b33c1356cdb57b1dac3a5ec5eb157a9eec5c933a2b0b2035f4033393db8badac60f4d9
SSDEEP

6144:TE9eMLIjdWdvwXXuqmDxIA3wkAyxHZUYCjUrpcrFiLDcUfqxwz74Gk96kAD:TpaJZMeqmDXXA6CjUrqiLOxwz7Y

Score

10^/10

warzonerat discovery infostealer rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
11844	win32.exe
11704	win32.exe

Loads dropped DLL 2 IoCs

pid	Process
11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
11844	win32.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2304 set thread context of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 11844 set thread context of 11704	11844	win32.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2164	powershell.exe
2900	powershell.exe
2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
11932	powershell.exe
12100	powershell.exe
11844	win32.exe
11844	win32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeIncreaseQuotaPrivilege	2164	powershell.exe
Token: SeSecurityPrivilege	2164	powershell.exe
Token: SeTakeOwnershipPrivilege	2164	powershell.exe
Token: SeLoadDriverPrivilege	2164	powershell.exe
Token: SeSystemProfilePrivilege	2164	powershell.exe
Token: SeSystemtimePrivilege	2164	powershell.exe
Token: SeProfSingleProcessPrivilege	2164	powershell.exe
Token: SeIncBasePriorityPrivilege	2164	powershell.exe
Token: SeCreatePagefilePrivilege	2164	powershell.exe
Token: SeBackupPrivilege	2164	powershell.exe
Token: SeRestorePrivilege	2164	powershell.exe
Token: SeShutdownPrivilege	2164	powershell.exe
Token: SeDebugPrivilege	2164	powershell.exe
Token: SeSystemEnvironmentPrivilege	2164	powershell.exe
Token: SeRemoteShutdownPrivilege	2164	powershell.exe
Token: SeUndockPrivilege	2164	powershell.exe
Token: SeManageVolumePrivilege	2164	powershell.exe
Token: 33	2164	powershell.exe
Token: 34	2164	powershell.exe
Token: 35	2164	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeIncreaseQuotaPrivilege	2900	powershell.exe
Token: SeSecurityPrivilege	2900	powershell.exe
Token: SeTakeOwnershipPrivilege	2900	powershell.exe
Token: SeLoadDriverPrivilege	2900	powershell.exe
Token: SeSystemProfilePrivilege	2900	powershell.exe
Token: SeSystemtimePrivilege	2900	powershell.exe
Token: SeProfSingleProcessPrivilege	2900	powershell.exe
Token: SeIncBasePriorityPrivilege	2900	powershell.exe
Token: SeCreatePagefilePrivilege	2900	powershell.exe
Token: SeBackupPrivilege	2900	powershell.exe
Token: SeRestorePrivilege	2900	powershell.exe
Token: SeShutdownPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeSystemEnvironmentPrivilege	2900	powershell.exe
Token: SeRemoteShutdownPrivilege	2900	powershell.exe
Token: SeUndockPrivilege	2900	powershell.exe
Token: SeManageVolumePrivilege	2900	powershell.exe
Token: 33	2900	powershell.exe
Token: 34	2900	powershell.exe
Token: 35	2900	powershell.exe
Token: SeDebugPrivilege	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
Token: SeDebugPrivilege	11932	powershell.exe
Token: SeIncreaseQuotaPrivilege	11932	powershell.exe
Token: SeSecurityPrivilege	11932	powershell.exe
Token: SeTakeOwnershipPrivilege	11932	powershell.exe
Token: SeLoadDriverPrivilege	11932	powershell.exe
Token: SeSystemProfilePrivilege	11932	powershell.exe
Token: SeSystemtimePrivilege	11932	powershell.exe
Token: SeProfSingleProcessPrivilege	11932	powershell.exe
Token: SeIncBasePriorityPrivilege	11932	powershell.exe
Token: SeCreatePagefilePrivilege	11932	powershell.exe
Token: SeBackupPrivilege	11932	powershell.exe
Token: SeRestorePrivilege	11932	powershell.exe
Token: SeShutdownPrivilege	11932	powershell.exe
Token: SeDebugPrivilege	11932	powershell.exe
Token: SeSystemEnvironmentPrivilege	11932	powershell.exe
Token: SeRemoteShutdownPrivilege	11932	powershell.exe
Token: SeUndockPrivilege	11932	powershell.exe
Token: SeManageVolumePrivilege	11932	powershell.exe
Token: 33	11932	powershell.exe
Token: 34	11932	powershell.exe
Token: 35	11932	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2164	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	29
PID 2304 wrote to memory of 2164	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	29
PID 2304 wrote to memory of 2164	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	29
PID 2304 wrote to memory of 2164	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	29
PID 2304 wrote to memory of 2900	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	32
PID 2304 wrote to memory of 2900	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	32
PID 2304 wrote to memory of 2900	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	32
PID 2304 wrote to memory of 2900	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	32
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 2304 wrote to memory of 11728	2304	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	34
PID 11728 wrote to memory of 11836	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	35
PID 11728 wrote to memory of 11836	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	35
PID 11728 wrote to memory of 11836	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	35
PID 11728 wrote to memory of 11836	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	35
PID 11728 wrote to memory of 11844	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	36
PID 11728 wrote to memory of 11844	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	36
PID 11728 wrote to memory of 11844	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	36
PID 11728 wrote to memory of 11844	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	36
PID 11728 wrote to memory of 11844	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	36
PID 11728 wrote to memory of 11844	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	36
PID 11728 wrote to memory of 11844	11728	5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe	36
PID 11844 wrote to memory of 11932	11844	win32.exe	38
PID 11844 wrote to memory of 11932	11844	win32.exe	38
PID 11844 wrote to memory of 11932	11844	win32.exe	38
PID 11844 wrote to memory of 11932	11844	win32.exe	38
PID 11836 wrote to memory of 11956	11836	cmd.exe	40
PID 11836 wrote to memory of 11956	11836	cmd.exe	40
PID 11836 wrote to memory of 11956	11836	cmd.exe	40
PID 11836 wrote to memory of 11956	11836	cmd.exe	40
PID 11844 wrote to memory of 12100	11844	win32.exe	41
PID 11844 wrote to memory of 12100	11844	win32.exe	41
PID 11844 wrote to memory of 12100	11844	win32.exe	41
PID 11844 wrote to memory of 12100	11844	win32.exe	41
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11844 wrote to memory of 11704	11844	win32.exe	43
PID 11704 wrote to memory of 2072	11704	win32.exe	44
PID 11704 wrote to memory of 2072	11704	win32.exe	44
PID 11704 wrote to memory of 2072	11704	win32.exe	44
PID 11704 wrote to memory of 2072	11704	win32.exe	44
PID 11704 wrote to memory of 2072	11704	win32.exe	44

C:\Users\Admin\AppData\Local\Temp\5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2164
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\5e87783b71d535bcaf402e2278c91048_JaffaCakes118.exe
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:11728
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:11836
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:11956
- - C:\ProgramData\win32.exe
    "C:\ProgramData\win32.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:11844
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:11932
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:12100
  - - C:\Users\Admin\AppData\Local\Temp\win32.exe
      C:\Users\Admin\AppData\Local\Temp\win32.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:11704
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
5ba927de24e299f0753be38086a58f65

SHA1
8a58f8edaa3f40e4415f544010326d9fdac8c232

SHA256
21b47a10a496daa27c2085dfe251b8b290da9b945698f30b96e6d7ff070df957

SHA512
051c01928f649849bd332033999a4c8ea60824c1ca9f1bd59634b0b4adb8653591533b1560cfeb69159ee129b187ee007501968a2ed3b3a4bca9e2dfba7c4d22

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
d125385b6fb90bd67dbec9cea4e3b062

SHA1
c89dbdffb6fe539cdeb6b13b051b2d2bf823e446

SHA256
fda7c5e9a4431b82fd6f5d96b38820376e05079f86aa82ee2cb220afb227db93

SHA512
1c9482e3847d3f7eca521851125a8004adf174632a4bc0b8357ba3980e4e911fe04569a961c4cd842edca3f11abc31291fdd085794ff4fae102256d0277ff717

Download Submit
\ProgramData\win32.exe

Filesize
440KB

MD5
5e87783b71d535bcaf402e2278c91048

SHA1
7e7faec34ecbe87ec3d18a402ff2e71fe3dcb533

SHA256
7c226fda60b190a13b95e0e5e992506ec7214ef9789e2117b4ee11981dad3158

SHA512
f1851e0d8fdcaeb22c3405b2bd23d9397e92fa367bc6576b8f0f200458b33c1356cdb57b1dac3a5ec5eb157a9eec5c933a2b0b2035f4033393db8badac60f4d9

Download Submit
memory/2164-5-0x00000000027F0000-0x0000000002830000-memory.dmp

Filesize
256KB

Download
memory/2164-7-0x00000000027F0000-0x0000000002830000-memory.dmp

Filesize
256KB

Download
memory/2304-80-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-72-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-6-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2304-15-0x0000000004C60000-0x0000000004CBC000-memory.dmp

Filesize
368KB

Download
memory/2304-16-0x0000000004F80000-0x0000000005000000-memory.dmp

Filesize
512KB

Download
memory/2304-38-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-36-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-34-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-32-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-30-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-28-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-26-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-24-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-22-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-20-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-18-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-17-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-76-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-0-0x000000007447E000-0x000000007447F000-memory.dmp

Filesize
4KB

Download
memory/2304-78-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-74-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-8-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-70-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-52-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-68-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-66-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-64-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-62-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-60-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-58-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-56-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-54-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-50-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-48-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-46-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-44-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-42-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-40-0x0000000004F80000-0x0000000004FFA000-memory.dmp

Filesize
488KB

Download
memory/2304-2510-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-2-0x0000000074470000-0x0000000074B5E000-memory.dmp

Filesize
6.9MB

Download
memory/2304-1-0x0000000000150000-0x00000000001C4000-memory.dmp

Filesize
464KB

Download
memory/11844-2524-0x00000000009F0000-0x0000000000A64000-memory.dmp

Filesize
464KB

Download