qakbot | 77689dd8ac7abb2a72720d542047f60f1fbc7a32d66c0bbd3a68220b4dad9b4d

Analysis

max time kernel
166s
max time network
146s
platform
windows10_x64
resource
win10-20220414-en
submitted
12-07-2022 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TXRTN_0620236/WindowsCodecs.dll
Size

4KB
MD5

491e9489c9e11f8b9d3d77239559a194
SHA1

f5df8d4edfdc22646c106259c21abe8d79195e31
SHA256

6e3661049bde832369781afa1d9034315442b1e4b87aa92d571cbe73186997c5
SHA512

ef0bd113fe6b64d7673b33cce559bdc0cfc99c81baac78c4a15b00b7eeb07470aa36e0f29a695b615fe149858a23733015c467948d889ffbee9a1fc916e2ceae

Score

10^/10

qakbot obama200 1657548298 banker stealer trojan

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama200

Campaign

1657548298

172.115.177.204:2222

89.101.97.139:443

186.90.153.162:2222

38.70.253.226:2222

120.150.218.241:995

72.252.157.93:995

72.252.157.93:993

94.36.193.176:2222

47.23.89.60:993

89.211.209.234:2222

76.25.142.196:443

46.100.25.239:61202

24.158.23.166:995

69.14.172.24:443

92.132.132.81:2222

37.34.253.233:443

93.48.80.198:995

174.80.15.101:2083

24.178.196.158:2222

197.89.20.137:443

Attributes

salt
jHxastDcds)oMc=jvh7wdUhxcsdt2

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

932 regsvr32.exe

pid	process
932	regsvr32.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

880 schtasks.exe

pid	process
880	schtasks.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

powershell.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\3d6fa871 = 3d5d292c850a7c076b216bb48cc2fc2f0bf51cf92977	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\fa9aa0e2 = 8a91f42f7b538ddd9395f7af2e8b05798cc431c870525371e1275b31a9178df6d9530092dc85557299e726aa96ffb024ca7a7381174abefae0e087f1e8df30c6081c0218ab16ac1117e8e380d6dbea9cf8bcb83693b2c6006a7bc5ecdd8f9c2a747c76b3595b891ead6fa76177d450048edfeb5aff925af072f111190d12bf59cc56ed58baea	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\f8db809e = f50d9ca6133e6319450cfca4a493e8ee9699697aa3eefa147845347818758cd2b19243e439956f190b5225b7c342068996	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\cf0570ac = 56f10659bc4aa7c4ef	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\85d3cf14 = 1d457be7a176c04c88cf8fcf8373b84f7990a0daa4353f231b028a6c55af54	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\4226c787 = 34bb1d8f930f8975393c64c4c85ee266dfa0f612fc9387a977f61f28b2e6736928ebbf5bbfa5b396b06e8340cb0c44ea670fb8b367c5bed7c71a6750bd7dd08b521e3c51fee35ce82cd779ad21b8099b0182928a2c1d3b2f5f3157202088dee96ef7e899	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\b04c1f5a = fc0e6b779e7ed9f69a9c33bbeae6ea	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\4067e7fb = a2ef8c61350964c51f5a81554576e17ce340d0391829bcc2a946c800671f3867b7845aadae4eaa9b995650f1ee50a24e2449d2a9ce181566e7916e3b5c272b22c3d01458884e34c8363faf75661ec4a485e2c11be96940cdc818ebc096e73aa75f3dd3a200053732fca20775b6c25d4368	explorer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Mbabvtsabqhzpy\cf0570ac = 56f11159bc4a94553c1e93e1f6e0f1a5af2a436af54d342988dfb309c102	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exeexplorer.exe

pid	process
4032	regsvr32.exe
4032	regsvr32.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe
2408	explorer.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

pid process

4032 regsvr32.exe
932 regsvr32.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3872 powershell.exe

description	pid	process
Token: SeDebugPrivilege	3872	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeexplorer.exepowershell.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 3844 wrote to memory of 3896	3844	regsvr32.exe	regsvr32.exe
PID 3844 wrote to memory of 3896	3844	regsvr32.exe	regsvr32.exe
PID 3844 wrote to memory of 3896	3844	regsvr32.exe	regsvr32.exe
PID 3896 wrote to memory of 4032	3896	regsvr32.exe	regsvr32.exe
PID 3896 wrote to memory of 4032	3896	regsvr32.exe	regsvr32.exe
PID 3896 wrote to memory of 4032	3896	regsvr32.exe	regsvr32.exe
PID 4032 wrote to memory of 2408	4032	regsvr32.exe	explorer.exe
PID 4032 wrote to memory of 2408	4032	regsvr32.exe	explorer.exe
PID 4032 wrote to memory of 2408	4032	regsvr32.exe	explorer.exe
PID 4032 wrote to memory of 2408	4032	regsvr32.exe	explorer.exe
PID 4032 wrote to memory of 2408	4032	regsvr32.exe	explorer.exe
PID 2408 wrote to memory of 880	2408	explorer.exe	schtasks.exe
PID 2408 wrote to memory of 880	2408	explorer.exe	schtasks.exe
PID 2408 wrote to memory of 880	2408	explorer.exe	schtasks.exe
PID 3872 wrote to memory of 1696	3872	powershell.exe	regsvr32.exe
PID 3872 wrote to memory of 1696	3872	powershell.exe	regsvr32.exe
PID 1696 wrote to memory of 932	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 932	1696	regsvr32.exe	regsvr32.exe
PID 1696 wrote to memory of 932	1696	regsvr32.exe	regsvr32.exe
PID 932 wrote to memory of 1980	932	regsvr32.exe	explorer.exe
PID 932 wrote to memory of 1980	932	regsvr32.exe	explorer.exe
PID 932 wrote to memory of 1980	932	regsvr32.exe	explorer.exe
PID 932 wrote to memory of 1980	932	regsvr32.exe	explorer.exe
PID 932 wrote to memory of 1980	932	regsvr32.exe	explorer.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\WindowsCodecs.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\WindowsCodecs.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe 102755.dll
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 21:07 /tn alswiafg /ET 21:18 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVABYAFIAVABOAF8AMAA2ADIAMAAyADMANgBcADEAMAAyADcANQA1AC4AZABsAGwAIgA=" /SC ONCE
        5⤵
        Creates scheduled task(s)
        
        PID:880

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAVABYAFIAVABOAF8AMAA2ADIAMAAyADMANgBcADEAMAAyADcANQA1AC4AZABsAGwAIgA=
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\system32\regsvr32.exe
  "C:\Windows\system32\regsvr32.exe" C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      4⤵
      Modifies data under HKEY_USERS
      PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll

Filesize
686KB

MD5
20b511612dcddebce1068aac505ce9c4

SHA1
dad3a4d17d36b30cb810f103fe118b180d52a5c6

SHA256
c74f98ed3ccdec5282fb3e7b93c9fd900f62b7a148c274ad866acc568e80c77c

SHA512
33a0f213f7a40da841f08f50297186487ebe934f7dde43378789a23844e2fc9ec7109bacce5d22e4573a869df261645f2dbc8978081904af1efdfa694af5306b

Download Submit
\Users\Admin\AppData\Local\Temp\TXRTN_0620236\102755.dll

Filesize
686KB

MD5
20b511612dcddebce1068aac505ce9c4

SHA1
dad3a4d17d36b30cb810f103fe118b180d52a5c6

SHA256
c74f98ed3ccdec5282fb3e7b93c9fd900f62b7a148c274ad866acc568e80c77c

SHA512
33a0f213f7a40da841f08f50297186487ebe934f7dde43378789a23844e2fc9ec7109bacce5d22e4573a869df261645f2dbc8978081904af1efdfa694af5306b

Download Submit
memory/880-287-0x0000000000000000-mapping.dmp

Download
memory/932-443-0x0000000003790000-0x00000000037B2000-memory.dmp

Filesize
136KB

Download
memory/932-330-0x0000000000000000-mapping.dmp

Download
memory/932-383-0x0000000003750000-0x000000000378F000-memory.dmp

Filesize
252KB

Download
memory/932-384-0x0000000003790000-0x00000000037B2000-memory.dmp

Filesize
136KB

Download
memory/1696-327-0x0000000000000000-mapping.dmp

Download
memory/1980-385-0x0000000000000000-mapping.dmp

Download
memory/1980-453-0x0000000000960000-0x0000000000982000-memory.dmp

Filesize
136KB

Download
memory/1980-454-0x0000000000960000-0x0000000000982000-memory.dmp

Filesize
136KB

Download
memory/2408-225-0x0000000000000000-mapping.dmp

Download
memory/2408-315-0x00000000008F0000-0x0000000000912000-memory.dmp

Filesize
136KB

Download
memory/2408-314-0x00000000008F0000-0x0000000000912000-memory.dmp

Filesize
136KB

Download
memory/3872-324-0x000002253C410000-0x000002253C486000-memory.dmp

Filesize
472KB

Download
memory/3872-321-0x00000225239A0000-0x00000225239C2000-memory.dmp

Filesize
136KB

Download
memory/3896-143-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-122-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-135-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-137-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-138-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-136-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-139-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-140-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-142-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-144-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-145-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-147-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-148-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-150-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-151-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-149-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-152-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-154-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-153-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-155-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-117-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-118-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-119-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-120-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-121-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-130-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-123-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-176-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-124-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-180-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-125-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-178-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-126-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-175-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-173-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-133-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-127-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-169-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-129-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-166-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-163-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-128-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-160-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-131-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-157-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-156-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-146-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-116-0x0000000000000000-mapping.dmp

Download
memory/3896-141-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-134-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/3896-132-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-172-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-223-0x0000000004870000-0x00000000048AF000-memory.dmp

Filesize
252KB

Download
memory/4032-284-0x00000000048D0000-0x00000000048F2000-memory.dmp

Filesize
136KB

Download
memory/4032-224-0x00000000048D0000-0x00000000048F2000-memory.dmp

Filesize
136KB

Download
memory/4032-158-0x0000000000000000-mapping.dmp

Download
memory/4032-161-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-167-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-170-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-177-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-181-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-179-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-174-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-171-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-168-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-165-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-164-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-162-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download
memory/4032-159-0x0000000077570000-0x00000000776FE000-memory.dmp

Filesize
1.6MB

Download