qakbot | c118e4088bc5aaffebe7208df9f01da9d70ba625ba020c593723495c0954a203

Analysis

max time kernel
164s
max time network
179s
platform
windows10_x64
resource
win10-20220414-en
submitted
05-07-2022 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb4a0fd09d51b6e51dbb3a8ea5323121.exe
Size

1.2MB
MD5

cb4a0fd09d51b6e51dbb3a8ea5323121
SHA1

b35b1c7ad5c77c7ac7a8afde0bf7362a721aadbe
SHA256

c118e4088bc5aaffebe7208df9f01da9d70ba625ba020c593723495c0954a203
SHA512

808673f987e07bb0061d34f4017a1d9a2b4e7a68a01fb057a2bf7aeb61148129717bf82d21ede38dfeb5895c6beae5781842700bce5114294e826950b6bdcdea

Score

10^/10

qakbot abc008 1600855273 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

325.43

Botnet

abc008

Campaign

1600855273

77.30.99.99:995

122.165.181.76:995

72.28.255.159:995

108.46.145.30:443

45.77.193.83:443

207.246.75.201:443

108.5.34.248:443

203.198.96.200:443

188.52.107.171:995

184.96.141.112:993

74.129.24.163:443

24.218.181.15:443

197.57.51.59:443

217.162.149.212:443

24.27.82.216:2222

78.97.3.6:443

96.41.93.96:443

197.210.96.222:995

45.32.154.10:443

199.247.16.80:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

cb4a0fd09d51b6e51dbb3a8ea5323121.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	cb4a0fd09d51b6e51dbb3a8ea5323121.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings firefox.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3428 PING.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings	firefox.exe

pid	process
3428	PING.EXE

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

cb4a0fd09d51b6e51dbb3a8ea5323121.execb4a0fd09d51b6e51dbb3a8ea5323121.exe

pid	process
1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
2068	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
2068	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
2068	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
2068	cb4a0fd09d51b6e51dbb3a8ea5323121.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 1736 firefox.exe
Token: SeDebugPrivilege 1736 firefox.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

firefox.exe

pid process

1736 firefox.exe
1736 firefox.exe
1736 firefox.exe
1736 firefox.exe
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

firefox.exe

pid process

1736 firefox.exe
1736 firefox.exe
1736 firefox.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

firefox.exe

pid process

1736 firefox.exe

description	pid	process
Token: SeDebugPrivilege	1736	firefox.exe
Token: SeDebugPrivilege	1736	firefox.exe

pid	process
1736	firefox.exe
1736	firefox.exe
1736	firefox.exe
1736	firefox.exe

pid	process
1736	firefox.exe
1736	firefox.exe
1736	firefox.exe

pid	process
1736	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cb4a0fd09d51b6e51dbb3a8ea5323121.execmd.exefirefox.exefirefox.exe

description	pid	process	target process
PID 1220 wrote to memory of 2068	1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
PID 1220 wrote to memory of 2068	1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
PID 1220 wrote to memory of 2068	1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe	cb4a0fd09d51b6e51dbb3a8ea5323121.exe
PID 1220 wrote to memory of 1144	1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe	cmd.exe
PID 1220 wrote to memory of 1144	1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe	cmd.exe
PID 1220 wrote to memory of 1144	1220	cb4a0fd09d51b6e51dbb3a8ea5323121.exe	cmd.exe
PID 1144 wrote to memory of 3428	1144	cmd.exe	PING.EXE
PID 1144 wrote to memory of 3428	1144	cmd.exe	PING.EXE
PID 1144 wrote to memory of 3428	1144	cmd.exe	PING.EXE
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 4296 wrote to memory of 1736	4296	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3216	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3216	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 3744	1736	firefox.exe	firefox.exe
PID 1736 wrote to memory of 4228	1736	firefox.exe	firefox.exe

C:\Users\Admin\AppData\Local\Temp\cb4a0fd09d51b6e51dbb3a8ea5323121.exe
"C:\Users\Admin\AppData\Local\Temp\cb4a0fd09d51b6e51dbb3a8ea5323121.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\cb4a0fd09d51b6e51dbb3a8ea5323121.exe
C:\Users\Admin\AppData\Local\Temp\cb4a0fd09d51b6e51dbb3a8ea5323121.exe /C
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\cb4a0fd09d51b6e51dbb3a8ea5323121.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
3⤵
- Runs ping.exe
PID:3428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4296

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.0.177700718\963712824" -parentBuildID 20200403170909 -prefsHandle 1548 -prefMapHandle 1540 -prefsLen 1 -prefMapSize 219987 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 1628 gpu
3⤵
PID:3216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.3.300148296\1775335078" -childID 1 -isForBrowser -prefsHandle 2256 -prefMapHandle 2252 -prefsLen 156 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 2264 tab
3⤵
PID:3744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1736.13.763165871\1892050194" -childID 2 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 6938 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1736 "\\.\pipe\gecko-crash-server-pipe.1736" 3444 tab
3⤵
PID:4228

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1144-227-0x0000000000000000-mapping.dmp

Download
memory/1220-115-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-116-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-117-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-118-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-119-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-120-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-121-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-122-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-123-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-124-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-125-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-126-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-127-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-128-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-129-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-130-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-131-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-132-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-133-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-134-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-135-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-137-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-136-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-138-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-139-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-140-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-141-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-144-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-143-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-145-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-146-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-142-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-147-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-148-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-149-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-150-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-151-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-152-0x0000000002360000-0x0000000002491000-memory.dmp

Filesize
1.2MB

Download
memory/1220-153-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-154-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-155-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-156-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-157-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-158-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-160-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1220-159-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-161-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/1220-180-0x0000000002360000-0x0000000002491000-memory.dmp

Filesize
1.2MB

Download
memory/1220-200-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1220-229-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2068-162-0x0000000000000000-mapping.dmp

Download
memory/2068-163-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-164-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-165-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-166-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-167-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-168-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-169-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-170-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-171-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-172-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-173-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-174-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-175-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-176-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-177-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-178-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-179-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-181-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-182-0x0000000077050000-0x00000000771DE000-memory.dmp

Filesize
1.6MB

Download
memory/2068-199-0x0000000002370000-0x00000000024A1000-memory.dmp

Filesize
1.2MB

Download
memory/2068-209-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/2068-214-0x0000000002370000-0x00000000024A1000-memory.dmp

Filesize
1.2MB

Download
memory/2068-215-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/3428-234-0x0000000000000000-mapping.dmp

Download