qakbot | ec38eb6ee133958ef6cc3bfa257d9368c615b3182d22282f63d12ca7f2b2c5be

Analysis

max time kernel
138s
max time network
44s
platform
windows10_x64
resource
win10v200430
submitted
26-05-2020 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

444444.png.exe
Size

2.3MB
MD5

f8849261a9db65164958d8c99ebc1f13
SHA1

004818f4c927ba99a0694fd94cc754dd4df731fd
SHA256

ec38eb6ee133958ef6cc3bfa257d9368c615b3182d22282f63d12ca7f2b2c5be
SHA512

7532e2943353bc7c38b54c7c128f27cccc41cfc2e5dfc86cd899de5c50b1af102f2dbd6648086a9d2d8b38797c27b6555fb2803594e2b7d1de266418e0b86bde

Score

10^/10

evasion trojan persistence banker stealer qakbot

Malware Config

Extracted

Family

qakbot

Botnet

spx96

Campaign

1586873043

72.209.191.27:443

173.22.120.11:2222

108.227.161.27:995

172.87.134.226:443

181.197.195.138:995

98.21.52.194:443

76.180.69.236:443

68.98.142.248:443

68.52.164.175:443

39.59.63.142:995

35.142.126.181:443

96.35.170.82:2222

75.111.145.5:443

47.214.144.253:443

74.105.139.160:443

67.8.103.21:443

50.108.212.180:443

83.25.7.201:2222

188.25.237.208:443

184.167.2.251:2222

Signatures

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\yopsmr = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Yxxoye\\zjxbasuk.exe\""	explorer.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\SpyNet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet	reg.exe

Executes dropped EXE 4 IoCs

Processes:

zjxbasuk.exezjxbasuk.exezjxbasuk.exezjxbasuk.exe

pid process

2116 zjxbasuk.exe
2580 zjxbasuk.exe
1988 zjxbasuk.exe
516 zjxbasuk.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

zjxbasuk.exe

pid process

2116 zjxbasuk.exe

pid	process
2116	zjxbasuk.exe
2580	zjxbasuk.exe
1988	zjxbasuk.exe
516	zjxbasuk.exe

pid	process
2116	zjxbasuk.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

444444.png.exezjxbasuk.exezjxbasuk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	444444.png.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	444444.png.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	444444.png.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	zjxbasuk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	zjxbasuk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	444444.png.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Service	zjxbasuk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	444444.png.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	444444.png.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Service	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	zjxbasuk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	zjxbasuk.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2172 schtasks.exe

pid	process
2172	schtasks.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye = "0"	reg.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

444444.png.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	444444.png.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	444444.png.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	444444.png.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	444444.png.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	444444.png.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

444444.png.exe444444.png.exezjxbasuk.exezjxbasuk.exeexplorer.exe444444.png.exezjxbasuk.exezjxbasuk.exe

pid	process
1876	444444.png.exe
1876	444444.png.exe
3788	444444.png.exe
3788	444444.png.exe
3788	444444.png.exe
3788	444444.png.exe
2116	zjxbasuk.exe
2116	zjxbasuk.exe
2580	zjxbasuk.exe
2580	zjxbasuk.exe
2580	zjxbasuk.exe
2580	zjxbasuk.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
2732	explorer.exe
3564	444444.png.exe
3564	444444.png.exe
1988	zjxbasuk.exe
1988	zjxbasuk.exe
516	zjxbasuk.exe
516	zjxbasuk.exe
516	zjxbasuk.exe
516	zjxbasuk.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

444444.png.exezjxbasuk.exe444444.png.exezjxbasuk.exe

description	pid	process	target process
PID 1876 wrote to memory of 3788	1876	444444.png.exe	444444.png.exe
PID 1876 wrote to memory of 3788	1876	444444.png.exe	444444.png.exe
PID 1876 wrote to memory of 3788	1876	444444.png.exe	444444.png.exe
PID 1876 wrote to memory of 2116	1876	444444.png.exe	zjxbasuk.exe
PID 1876 wrote to memory of 2116	1876	444444.png.exe	zjxbasuk.exe
PID 1876 wrote to memory of 2116	1876	444444.png.exe	zjxbasuk.exe
PID 1876 wrote to memory of 2172	1876	444444.png.exe	schtasks.exe
PID 1876 wrote to memory of 2172	1876	444444.png.exe	schtasks.exe
PID 1876 wrote to memory of 2172	1876	444444.png.exe	schtasks.exe
PID 2116 wrote to memory of 2580	2116	zjxbasuk.exe	zjxbasuk.exe
PID 2116 wrote to memory of 2580	2116	zjxbasuk.exe	zjxbasuk.exe
PID 2116 wrote to memory of 2580	2116	zjxbasuk.exe	zjxbasuk.exe
PID 2116 wrote to memory of 2732	2116	zjxbasuk.exe	explorer.exe
PID 2116 wrote to memory of 2732	2116	zjxbasuk.exe	explorer.exe
PID 2116 wrote to memory of 2732	2116	zjxbasuk.exe	explorer.exe
PID 2116 wrote to memory of 2732	2116	zjxbasuk.exe	explorer.exe
PID 3564 wrote to memory of 3888	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3888	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3448	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3448	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3544	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3544	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3616	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3616	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 728	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 728	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 1576	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 1576	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 1584	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 1584	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 1872	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 1872	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3736	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 3736	3564	444444.png.exe	reg.exe
PID 3564 wrote to memory of 1988	3564	444444.png.exe	zjxbasuk.exe
PID 3564 wrote to memory of 1988	3564	444444.png.exe	zjxbasuk.exe
PID 3564 wrote to memory of 1988	3564	444444.png.exe	zjxbasuk.exe
PID 1988 wrote to memory of 516	1988	zjxbasuk.exe	zjxbasuk.exe
PID 1988 wrote to memory of 516	1988	zjxbasuk.exe	zjxbasuk.exe
PID 1988 wrote to memory of 516	1988	zjxbasuk.exe	zjxbasuk.exe
PID 3564 wrote to memory of 3404	3564	444444.png.exe	cmd.exe
PID 3564 wrote to memory of 3404	3564	444444.png.exe	cmd.exe
PID 3564 wrote to memory of 2036	3564	444444.png.exe	schtasks.exe
PID 3564 wrote to memory of 2036	3564	444444.png.exe	schtasks.exe

Turns off Windows Defender SpyNet reporting 6 IoCs

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "2"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SpyNetReporting = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet\SubmitSamplesConsent = "2"	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2132 PING.EXE
Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot

pid	process
2132	PING.EXE

C:\Users\Admin\AppData\Local\Temp\444444.png.exe
"C:\Users\Admin\AppData\Local\Temp\444444.png.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Users\Admin\AppData\Local\Temp\444444.png.exe
  C:\Users\Admin\AppData\Local\Temp\444444.png.exe /C
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:3788
- C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:2580
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Adds Run entry to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2732
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn dtbrujrnly /tr "\"C:\Users\Admin\AppData\Local\Temp\444444.png.exe\" /I dtbrujrnly" /SC ONCE /Z /ST 18:07 /ET 18:19
  2⤵
  - Creates scheduled task(s)
  PID:2172

C:\Users\Admin\AppData\Local\Temp\444444.png.exe
C:\Users\Admin\AppData\Local\Temp\444444.png.exe /I dtbrujrnly
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  - Windows security modification
  - Turns off Windows Defender SpyNet reporting
  PID:3888
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  - Windows security modification
  - Turns off Windows Defender SpyNet reporting
  PID:3448
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:3544
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:3616
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  - Windows security modification
  - Turns off Windows Defender SpyNet reporting
  PID:728
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  - Windows security modification
  - Turns off Windows Defender SpyNet reporting
  PID:1576
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  - Windows security modification
  - Turns off Windows Defender SpyNet reporting
  PID:1584
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  - Windows security modification
  - Turns off Windows Defender SpyNet reporting
  PID:1872
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye" /d "0"
  2⤵
  - Windows security bypass
  PID:3736
- C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\444444.png.exe"
  2⤵
  PID:3404
- - C:\Windows\system32\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2132
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /DELETE /F /TN dtbrujrnly
  2⤵
  PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.dat

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Yxxoye\zjxbasuk.exe

Download Submit
memory/516-9-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/2116-5-0x0000000002400000-0x000000000243C000-memory.dmp

Filesize
240KB

Download
memory/2580-4-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/3788-0-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download