trickbot | bc387de543591660fa5cfb3f69e0c7d704b8be15b6ab631d2108477f1ea46424

Resubmissions

28-12-2022 22:24

221228-2bvfdsbg78 10

19-12-2022 21:10

221219-z1afeabc4y 10

Analysis

max time kernel
150s
max time network
58s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
28-12-2022 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zmoperes.ri.exe
Size

313KB
MD5

104b457b6d90fc80ff2dbbcebbb7ca8b
SHA1

7842611837af04d7c986de21ab2454ed397014de
SHA256

1c81272ffc28b29a82d8313bd74d1c6030c2af1ba4b165c44dc8ea6376679d9f
SHA512

504b6d45d0dbafadbefbc30d137ecf399a79bbfefe11418e5defec4f9b6ee66d170ecc12c5e9bd76511403d357d071e71d56f57e2587e558c3a91b3a0ef21df0
SSDEEP

6144:cqzfvclHbmBwuKj6BkT4GvEH5sLLJ6vd4p:cqzHWHbmQGBkT46689I

Score

10^/10

trickbot banker evasion persistence trojan

Malware Config

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 4 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/2124-152-0x0000000010000000-0x0000000010040000-memory.dmp	trickbot_loader32
behavioral1/memory/1688-165-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral1/memory/1688-233-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32
behavioral1/memory/4868-681-0x0000000000400000-0x000000000043D000-memory.dmp	trickbot_loader32

Executes dropped EXE 2 IoCs

Processes:

zmopeset.ri.exezmopeset.ri.exe

pid process

1944 zmopeset.ri.exe
4868 zmopeset.ri.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
1944	zmopeset.ri.exe
4868	zmopeset.ri.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe = "C:\\Users\\Admin\\AppData\\Roaming\\msnet\\zmopeset.ri.exe"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Windows\CurrentVersion\Run	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

zmoperes.ri.exezmopeset.ri.exe

description	pid	process	target process
PID 2124 set thread context of 1688	2124	zmoperes.ri.exe	zmoperes.ri.exe
PID 1944 set thread context of 4868	1944	zmopeset.ri.exe	zmopeset.ri.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

780 sc.exe
700 sc.exe
4876 sc.exe
2844 sc.exe

pid	process
780	sc.exe
700	sc.exe
4876	sc.exe
2844	sc.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

zmoperes.ri.exepowershell.exezmopeset.ri.exepowershell.exe

pid	process
1688	zmoperes.ri.exe
1688	zmoperes.ri.exe
1688	zmoperes.ri.exe
1688	zmoperes.ri.exe
1688	zmoperes.ri.exe
1688	zmoperes.ri.exe
4296	powershell.exe
4296	powershell.exe
4296	powershell.exe
4868	zmopeset.ri.exe
4868	zmopeset.ri.exe
4868	zmopeset.ri.exe
4868	zmopeset.ri.exe
4868	zmopeset.ri.exe
4868	zmopeset.ri.exe
4500	powershell.exe
4500	powershell.exe
4500	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

zmoperes.ri.exezmopeset.ri.exe

pid process

2124 zmoperes.ri.exe
1944 zmopeset.ri.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4296 powershell.exe
Token: SeDebugPrivilege 4500 powershell.exe

pid	process
2124	zmoperes.ri.exe
1944	zmopeset.ri.exe

description	pid	process
Token: SeDebugPrivilege	4296	powershell.exe
Token: SeDebugPrivilege	4500	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

zmoperes.ri.exezmoperes.ri.execmd.execmd.execmd.exezmopeset.ri.exezmopeset.ri.exe

description	pid	process	target process
PID 2124 wrote to memory of 1688	2124	zmoperes.ri.exe	zmoperes.ri.exe
PID 2124 wrote to memory of 1688	2124	zmoperes.ri.exe	zmoperes.ri.exe
PID 2124 wrote to memory of 1688	2124	zmoperes.ri.exe	zmoperes.ri.exe
PID 2124 wrote to memory of 1688	2124	zmoperes.ri.exe	zmoperes.ri.exe
PID 1688 wrote to memory of 1436	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 1436	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 1436	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 2844	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 2844	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 2844	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 2104	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 2104	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 2104	1688	zmoperes.ri.exe	cmd.exe
PID 1688 wrote to memory of 1944	1688	zmoperes.ri.exe	zmopeset.ri.exe
PID 1688 wrote to memory of 1944	1688	zmoperes.ri.exe	zmopeset.ri.exe
PID 1688 wrote to memory of 1944	1688	zmoperes.ri.exe	zmopeset.ri.exe
PID 2844 wrote to memory of 780	2844	cmd.exe	sc.exe
PID 1436 wrote to memory of 700	1436	cmd.exe	sc.exe
PID 2844 wrote to memory of 780	2844	cmd.exe	sc.exe
PID 2844 wrote to memory of 780	2844	cmd.exe	sc.exe
PID 1436 wrote to memory of 700	1436	cmd.exe	sc.exe
PID 1436 wrote to memory of 700	1436	cmd.exe	sc.exe
PID 2104 wrote to memory of 4296	2104	cmd.exe	powershell.exe
PID 2104 wrote to memory of 4296	2104	cmd.exe	powershell.exe
PID 2104 wrote to memory of 4296	2104	cmd.exe	powershell.exe
PID 1944 wrote to memory of 4868	1944	zmopeset.ri.exe	zmopeset.ri.exe
PID 1944 wrote to memory of 4868	1944	zmopeset.ri.exe	zmopeset.ri.exe
PID 1944 wrote to memory of 4868	1944	zmopeset.ri.exe	zmopeset.ri.exe
PID 1944 wrote to memory of 4868	1944	zmopeset.ri.exe	zmopeset.ri.exe
PID 4868 wrote to memory of 512	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 512	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 512	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 4320	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 4320	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 4320	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 4312	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 4312	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 4312	4868	zmopeset.ri.exe	cmd.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe
PID 4868 wrote to memory of 3180	4868	zmopeset.ri.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\zmoperes.ri.exe
"C:\Users\Admin\AppData\Local\Temp\zmoperes.ri.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2124

C:\Users\Admin\AppData\Local\Temp\zmoperes.ri.exe
"C:\Users\Admin\AppData\Local\Temp\zmoperes.ri.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:1436

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
4⤵
- Launches sc.exe
PID:700

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:2844

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
4⤵
- Launches sc.exe
PID:780

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
3⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe
C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1944

C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe
C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4868

C:\Windows\SysWOW64\cmd.exe
/c sc stop WinDefend
5⤵
PID:512

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
6⤵
- Launches sc.exe
PID:4876

C:\Windows\SysWOW64\cmd.exe
/c sc delete WinDefend
5⤵
PID:4320

C:\Windows\SysWOW64\sc.exe
sc delete WinDefend
6⤵
- Launches sc.exe
PID:2844

C:\Windows\SysWOW64\cmd.exe
/c powershell Set-MpPreference -DisableRealtimeMonitoring $true
5⤵
PID:4312

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableRealtimeMonitoring $true
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
5⤵
- Adds Run key to start application
PID:3180

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
b1a1b2a1a37f587aed4e1ec001849c32

SHA1
d3b87a74154bb7046645ba5acb770728b6288f8a

SHA256
7a40549515c0b9c48fa03a3c9c525b4a1b1b4fa036a21b3e966801cfb230de63

SHA512
e80f9023281b3e6ca6f6c21d39e712f728e4e27ef833f04772dca538336921c324497d9241ccff76ca85f26f4f33f2a54fd53d36cbaef42657fdc8eac26df2c5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2482096546-1136599444-1359412500-1000\0f5007522459c86e95ffcc62f32308f1_1adb157e-7186-4895-9c9e-46386703fc96
Filesize
1KB

MD5
987e3e95af5efbd34305bdf08753aa87

SHA1
4e893b1e1144a464edc6db6de749780c6522b7c2

SHA256
500bfdf947e9e188dcbfd1e04c710cc59ae0bf70f2d4e68e270dbe4bfe2b0936

SHA512
777387d6711565ef6230702bb69d7958d1de45e78fc729e4d4b5d52851ebb61899424e10ffeef38232a1bed305b29da441a381b24cfe57c69bdde61cbaa46907

Download Submit
C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe
Filesize
313KB

MD5
104b457b6d90fc80ff2dbbcebbb7ca8b

SHA1
7842611837af04d7c986de21ab2454ed397014de

SHA256
1c81272ffc28b29a82d8313bd74d1c6030c2af1ba4b165c44dc8ea6376679d9f

SHA512
504b6d45d0dbafadbefbc30d137ecf399a79bbfefe11418e5defec4f9b6ee66d170ecc12c5e9bd76511403d357d071e71d56f57e2587e558c3a91b3a0ef21df0

Download Submit
C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe
Filesize
313KB

MD5
104b457b6d90fc80ff2dbbcebbb7ca8b

SHA1
7842611837af04d7c986de21ab2454ed397014de

SHA256
1c81272ffc28b29a82d8313bd74d1c6030c2af1ba4b165c44dc8ea6376679d9f

SHA512
504b6d45d0dbafadbefbc30d137ecf399a79bbfefe11418e5defec4f9b6ee66d170ecc12c5e9bd76511403d357d071e71d56f57e2587e558c3a91b3a0ef21df0

Download Submit
C:\Users\Admin\AppData\Roaming\msnet\zmopeset.ri.exe
Filesize
313KB

MD5
104b457b6d90fc80ff2dbbcebbb7ca8b

SHA1
7842611837af04d7c986de21ab2454ed397014de

SHA256
1c81272ffc28b29a82d8313bd74d1c6030c2af1ba4b165c44dc8ea6376679d9f

SHA512
504b6d45d0dbafadbefbc30d137ecf399a79bbfefe11418e5defec4f9b6ee66d170ecc12c5e9bd76511403d357d071e71d56f57e2587e558c3a91b3a0ef21df0

Download Submit
memory/512-625-0x0000000000000000-mapping.dmp

Download
memory/700-221-0x0000000000000000-mapping.dmp

Download
memory/780-220-0x0000000000000000-mapping.dmp

Download
memory/1436-187-0x0000000000000000-mapping.dmp

Download
memory/1688-155-0x0000000000401000-mapping.dmp

Download
memory/1688-172-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-233-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-165-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/1688-184-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-185-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-183-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-180-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-182-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-181-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-179-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-178-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-177-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-176-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-175-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-174-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-173-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-164-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-168-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-171-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-169-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-170-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-167-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-166-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-156-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-157-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-158-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-159-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-160-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-162-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-161-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1688-163-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/1944-204-0x0000000000000000-mapping.dmp

Download
memory/2104-192-0x0000000000000000-mapping.dmp

Download
memory/2124-146-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-124-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-151-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-150-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-149-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-148-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-147-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-120-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-145-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-144-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-143-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-142-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-141-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-140-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-139-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-138-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-137-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-136-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-135-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-134-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-121-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-133-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-132-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-131-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-130-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-129-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-128-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-127-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-122-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-126-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-123-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2124-152-0x0000000010000000-0x0000000010040000-memory.dmp

Filesize
256KB

Download
memory/2124-125-0x0000000077710000-0x000000007789E000-memory.dmp

Filesize
1.6MB

Download
memory/2844-188-0x0000000000000000-mapping.dmp

Download
memory/2844-664-0x0000000000000000-mapping.dmp

Download
memory/3180-644-0x0000000000000000-mapping.dmp

Download
memory/4296-342-0x0000000008E20000-0x0000000008E3E000-memory.dmp

Filesize
120KB

Download
memory/4296-317-0x0000000006EF0000-0x0000000006F12000-memory.dmp

Filesize
136KB

Download
memory/4296-328-0x0000000007F90000-0x0000000008006000-memory.dmp

Filesize
472KB

Download
memory/4296-341-0x0000000008E40000-0x0000000008E73000-memory.dmp

Filesize
204KB

Download
memory/4296-318-0x0000000007800000-0x0000000007866000-memory.dmp

Filesize
408KB

Download
memory/4296-351-0x0000000009190000-0x0000000009235000-memory.dmp

Filesize
660KB

Download
memory/4296-355-0x0000000009380000-0x0000000009414000-memory.dmp

Filesize
592KB

Download
memory/4296-558-0x0000000009310000-0x000000000932A000-memory.dmp

Filesize
104KB

Download
memory/4296-563-0x0000000009300000-0x0000000009308000-memory.dmp

Filesize
32KB

Download
memory/4296-320-0x00000000078F0000-0x0000000007C40000-memory.dmp

Filesize
3.3MB

Download
memory/4296-319-0x0000000007620000-0x0000000007686000-memory.dmp

Filesize
408KB

Download
memory/4296-298-0x0000000006F80000-0x00000000075A8000-memory.dmp

Filesize
6.2MB

Download
memory/4296-293-0x0000000002CD0000-0x0000000002D06000-memory.dmp

Filesize
216KB

Download
memory/4296-324-0x00000000081B0000-0x00000000081FB000-memory.dmp

Filesize
300KB

Download
memory/4296-236-0x0000000000000000-mapping.dmp

Download
memory/4296-323-0x00000000077C0000-0x00000000077DC000-memory.dmp

Filesize
112KB

Download
memory/4312-629-0x0000000000000000-mapping.dmp

Download
memory/4320-626-0x0000000000000000-mapping.dmp

Download
memory/4500-656-0x0000000000000000-mapping.dmp

Download
memory/4500-738-0x0000000007540000-0x0000000007890000-memory.dmp

Filesize
3.3MB

Download
memory/4500-741-0x00000000079A0000-0x00000000079EB000-memory.dmp

Filesize
300KB

Download
memory/4500-765-0x0000000008DD0000-0x0000000008E75000-memory.dmp

Filesize
660KB

Download
memory/4868-681-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/4868-593-0x0000000000401000-mapping.dmp

Download
memory/4876-655-0x0000000000000000-mapping.dmp

Download