qakbot | 77689dd8ac7abb2a72720d542047f60f1fbc7a32d66c0bbd3a68220b4dad9b4d

Analysis

max time kernel
163s
max time network
165s
platform
windows10_x64
resource
win10-20220414-en
submitted
12-07-2022 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TXRTN_0620236/TXRTN_0620236.lnk
Size

1KB
MD5

eea824215afd2936b4b9c428558a11ed
SHA1

de5d15491319ee9c15c3bcbf215d9f6996f76776
SHA256

aa1add7b438592b57f9c7e53f5c19ead55d313824822835c73ca998f8e06134d
SHA512

24b0322fefbbb9eb57629f9396466cfbc79e205f126209319cd9ad2c83dda9a7975ac987058dc730e9149b6e315cfed35924e40a14a313655961bb4ed26a0b77

Score

10^/10

qakbot obama200 1657548298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

172.115.177.204:2222

89.101.97.139:443

186.90.153.162:2222

38.70.253.226:2222

120.150.218.241:995

72.252.157.93:995

72.252.157.93:993

94.36.193.176:2222

47.23.89.60:993

89.211.209.234:2222

76.25.142.196:443

46.100.25.239:61202

24.158.23.166:995

69.14.172.24:443

92.132.132.81:2222

37.34.253.233:443

93.48.80.198:995

174.80.15.101:2083

24.178.196.158:2222

197.89.20.137:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

1060 regsvr32.exe

pid	process
1060	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2860 schtasks.exe

pid	process
2860	schtasks.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\1bfea1d0 = aa24f7eb945dea4e3e415585fbc235e99de89e97211681d7d68828a4e39656fc8a950939a414f08372b30f5efa035f32192b1204f89e8edb7f85237f3fcfcd3dd68ac7b38f71b91db534e6bd617ed800e71496c29411c998a13df45901674e82b734fe2d41ce32e2160911ec13f57665	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\66f6ee5a = 3ac1f40c6a3a684352c54da47aaaba9611088fb6	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\e994790d = 24615d69d5d0234f7d0a4abc0955fa13f934c6992c14fc55583f3831357f5989df6a1a338ff4a9415255fb7b2be79ceff88396fe66ded959fd84fa94cbcd18c916f57137d0466f	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\dc0ba943 = 6c333ce83bfd2eabfa910b677a4356f29fdcfb3990fea6fe8da22db230d8d920d8e2820af5de20add5b78d397c5b94fe7df5964718545a02f0ab7a0efcf703cfd1d97a012ebc5be84fd4dc867998e63ab4ad4572bd1f51b855ee15bd03f51ee0c46c7aae05c68a947729d6dba5c27ce3d9f164f0d9a797c7687863f4d9f7ea9c36fb17f7cec3fa2859389a05c55c77fea6338f4057a76b7a4b2d4ef091b2138b3d04a64fe50eb9589373bbc9ef0a684744932676b06ca66027a827c53637ca087ba34d	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\de4a893f = 1c4fcc9750ab79844ff0fdf5b1c9df874c9609063ab7a4b8952442d9593b7795815c8c8e6fd66bdcd22aba1c2361aa9f359f2d42e1c97abf1cd63f624ddec88a353b59d9d3c4db6d670607c3b7fc466932b39eaaa77d234c64bcc2f5d0b2a1	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\e994790d = 24614a69d5d010d2c08b55b9659a52d9d7abdea96b780daa321078d0ff2d879326892329c510185727cc8e712c16765f6003	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\64b7ce26 = a6de3826b0399159e830ef49c0ee8ae50f346bb7be7d688c29460d2acdb34bbd99e8fd67e2759c7b312c57a10ccb555b77e65b4d4e537a2b94801550d2cbfa2c01e9e12943fb51f3dce2528fc5093f52dd02	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\a342c6b5 = 837e90e71cb32e5408af28daa6ce5f713fd34b47680bf987425ef2f58ccb1c9d21b5236be73655a7a48fd517d08af404719d713b	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Pgrtaorn\96dd16fb = 7011d2d97d97347fdc6ecde9fc4b451c199d83c52d98c16768799b066e11a699103a8c0a78b1fdc5f094c42c875d6edd1245	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
2696	regsvr32.exe
2696	regsvr32.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe
204	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

2696 regsvr32.exe
1060 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4068 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4068	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

cmd.execmd.execalc.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3068 wrote to memory of 1276	3068	cmd.exe	cmd.exe
PID 3068 wrote to memory of 1276	3068	cmd.exe	cmd.exe
PID 1276 wrote to memory of 1312	1276	cmd.exe	calc.exe
PID 1276 wrote to memory of 1312	1276	cmd.exe	calc.exe
PID 1276 wrote to memory of 1312	1276	cmd.exe	calc.exe
PID 1312 wrote to memory of 2696	1312	calc.exe	regsvr32.exe
PID 1312 wrote to memory of 2696	1312	calc.exe	regsvr32.exe
PID 1312 wrote to memory of 2696	1312	calc.exe	regsvr32.exe
PID 2696 wrote to memory of 204	2696	regsvr32.exe	explorer.exe
PID 2696 wrote to memory of 204	2696	regsvr32.exe	explorer.exe
PID 2696 wrote to memory of 204	2696	regsvr32.exe	explorer.exe
PID 2696 wrote to memory of 204	2696	regsvr32.exe	explorer.exe
PID 2696 wrote to memory of 204	2696	regsvr32.exe	explorer.exe
PID 204 wrote to memory of 2860	204	explorer.exe	schtasks.exe
PID 204 wrote to memory of 2860	204	explorer.exe	schtasks.exe
PID 204 wrote to memory of 2860	204	explorer.exe	schtasks.exe
PID 4068 wrote to memory of 3164	4068	powershell.exe	regsvr32.exe
PID 4068 wrote to memory of 3164	4068	powershell.exe	regsvr32.exe
PID 3164 wrote to memory of 1060	3164	regsvr32.exe	regsvr32.exe
PID 3164 wrote to memory of 1060	3164	regsvr32.exe	regsvr32.exe
PID 3164 wrote to memory of 1060	3164	regsvr32.exe	regsvr32.exe
PID 1060 wrote to memory of 2032	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 2032	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 2032	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 2032	1060	regsvr32.exe	explorer.exe
PID 1060 wrote to memory of 2032	1060	regsvr32.exe	explorer.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\TXRTN_0620236.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /q /c calc.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\calc.exe
    calc.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\SysWOW64\regsvr32.exe 102755.dll
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:204
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 21:07 /tn axodptvhb /ET 21:18 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVABYAFIAVABOAF8AMAA2ADIAMAAyADMANgBcADEAMAAyADcANQA1AC4AZABsAGwAIgA=" /SC ONCE
        6⤵
        Creates scheduled task(s)
        
        PID:2860

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVABYAFIAVABOAF8AMAA2ADIAMAAyADMANgBcADEAMAAyADcANQA1AC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll

Filesize
686KB

MD5
20b511612dcddebce1068aac505ce9c4

SHA1
dad3a4d17d36b30cb810f103fe118b180d52a5c6

SHA256
c74f98ed3ccdec5282fb3e7b93c9fd900f62b7a148c274ad866acc568e80c77c

SHA512
33a0f213f7a40da841f08f50297186487ebe934f7dde43378789a23844e2fc9ec7109bacce5d22e4573a869df261645f2dbc8978081904af1efdfa694af5306b

Download Submit
\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll

Filesize
686KB

MD5
20b511612dcddebce1068aac505ce9c4

SHA1
dad3a4d17d36b30cb810f103fe118b180d52a5c6

SHA256
c74f98ed3ccdec5282fb3e7b93c9fd900f62b7a148c274ad866acc568e80c77c

SHA512
33a0f213f7a40da841f08f50297186487ebe934f7dde43378789a23844e2fc9ec7109bacce5d22e4573a869df261645f2dbc8978081904af1efdfa694af5306b

Download Submit
memory/204-218-0x0000000000000000-mapping.dmp

Download
memory/204-307-0x0000000000880000-0x00000000008A2000-memory.dmp

Filesize
136KB

Download
memory/204-308-0x0000000000880000-0x00000000008A2000-memory.dmp

Filesize
136KB

Download
memory/1060-435-0x0000000003B60000-0x0000000003B82000-memory.dmp

Filesize
136KB

Download
memory/1060-375-0x0000000003B20000-0x0000000003B5F000-memory.dmp

Filesize
252KB

Download
memory/1060-376-0x0000000003B60000-0x0000000003B82000-memory.dmp

Filesize
136KB

Download
memory/1060-322-0x0000000000000000-mapping.dmp

Download
memory/1276-119-0x0000000000000000-mapping.dmp

Download
memory/1312-158-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-148-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-127-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-128-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-129-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-131-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-130-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-133-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-134-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-132-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-135-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-136-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-137-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-139-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-138-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-141-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-143-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-145-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-147-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-146-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-149-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-124-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-144-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-150-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-142-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-140-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-151-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-153-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-152-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-154-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-155-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-156-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-125-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-157-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-159-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-123-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-122-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-126-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/1312-120-0x0000000000000000-mapping.dmp

Download
memory/1312-121-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2032-377-0x0000000000000000-mapping.dmp

Download
memory/2032-445-0x0000000000840000-0x0000000000862000-memory.dmp

Filesize
136KB

Download
memory/2032-446-0x0000000000840000-0x0000000000862000-memory.dmp

Filesize
136KB

Download
memory/2696-166-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-160-0x0000000000000000-mapping.dmp

Download
memory/2696-177-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-171-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-169-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-179-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-181-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-183-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-185-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-184-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-182-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-180-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-178-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-168-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-165-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-163-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-162-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-176-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-216-0x0000000000ED0000-0x0000000000F0F000-memory.dmp

Filesize
252KB

Download
memory/2696-217-0x0000000004AE0000-0x0000000004B02000-memory.dmp

Filesize
136KB

Download
memory/2696-277-0x0000000004AE0000-0x0000000004B02000-memory.dmp

Filesize
136KB

Download
memory/2696-161-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-164-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-175-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-174-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-173-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-172-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-170-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2696-167-0x0000000076FF0000-0x000000007717E000-memory.dmp

Filesize
1.6MB

Download
memory/2860-280-0x0000000000000000-mapping.dmp

Download
memory/3164-319-0x0000000000000000-mapping.dmp

Download
memory/4068-313-0x000001C63F500000-0x000001C63F522000-memory.dmp

Filesize
136KB

Download
memory/4068-316-0x000001C63F6B0000-0x000001C63F726000-memory.dmp

Filesize
472KB

Download