tinba | 71ab0b52cc7387526cb561fbf2c95f5649fa877dad1082451a368309ebced41c

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b017d782a26ff7c3c368a2e57efddcd3.exe
Size 160KB
Sample240301-cwvt8aah32
SHA256 71ab0b52cc7387526cb561fbf2c95f5649fa877dad1082451a368309ebced41c
MD5 b017d782a26ff7c3c368a2e57efddcd3
SHA1 41b137859cb071ba957ef10c85ee09fa1fb67dc3
SHA512 44fc5eab7c60ff2e420ed6052550d7763c72c4cf4bc91b82fa02f2856f245ab17cac27e26c8dbbe4d2090582b7ed03c80ab66116fb1b6366f7503d5ba813e0c1
SSDEEP 1536:HEY+mFM2HXKZgi0Iksu+XM5/HtAQ9J6xph:kY+4MiIkLZJNAQ9J6v
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

tinba banker persistence trojan upx

Malware Config

Signatures

Tinba / TinyBanker
Banking trojan which uses packet sniffing to steal data.
trojan banker tinba

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/728-0-0x0000000000400000-0x0000000000428000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11312895 = "C:\\Users\\Admin\\AppData\\Roaming\\11312895\\bin.exe"	winver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe
5036	winver.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3332	Explorer.EXE
Token: SeCreatePagefilePrivilege	3332	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5036	winver.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3332	Explorer.EXE
3880	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 5036	728	b017d782a26ff7c3c368a2e57efddcd3.exe	97
PID 728 wrote to memory of 5036	728	b017d782a26ff7c3c368a2e57efddcd3.exe	97
PID 728 wrote to memory of 5036	728	b017d782a26ff7c3c368a2e57efddcd3.exe	97
PID 728 wrote to memory of 5036	728	b017d782a26ff7c3c368a2e57efddcd3.exe	97
PID 5036 wrote to memory of 3332	5036	winver.exe	57
PID 5036 wrote to memory of 2416	5036	winver.exe	42
PID 5036 wrote to memory of 2448	5036	winver.exe	43
PID 5036 wrote to memory of 2520	5036	winver.exe	46
PID 5036 wrote to memory of 3332	5036	winver.exe	57
PID 5036 wrote to memory of 3468	5036	winver.exe	58
PID 5036 wrote to memory of 3732	5036	winver.exe	59
PID 5036 wrote to memory of 3880	5036	winver.exe	60
PID 5036 wrote to memory of 3944	5036	winver.exe	61
PID 5036 wrote to memory of 4028	5036	winver.exe	62
PID 5036 wrote to memory of 2140	5036	winver.exe	63
PID 5036 wrote to memory of 2260	5036	winver.exe	65
PID 5036 wrote to memory of 544	5036	winver.exe	75
PID 5036 wrote to memory of 4880	5036	winver.exe	76
PID 5036 wrote to memory of 3856	5036	winver.exe	78
PID 5036 wrote to memory of 4920	5036	winver.exe	79
PID 5036 wrote to memory of 3124	5036	winver.exe	80
PID 5036 wrote to memory of 1576	5036	winver.exe	81
PID 5036 wrote to memory of 4988	5036	winver.exe	82
PID 5036 wrote to memory of 3612	5036	winver.exe	84
PID 5036 wrote to memory of 4156	5036	winver.exe	85
PID 5036 wrote to memory of 2024	5036	winver.exe	90
PID 5036 wrote to memory of 4808	5036	winver.exe	91
PID 5036 wrote to memory of 3828	5036	winver.exe	92
PID 5036 wrote to memory of 1588	5036	winver.exe	98
PID 5036 wrote to memory of 4924	5036	winver.exe	99
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105
PID 3856 wrote to memory of 1160	3856	msedge.exe	105

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2448

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2520

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3332
- C:\Users\Admin\AppData\Local\Temp\b017d782a26ff7c3c368a2e57efddcd3.exe
  "C:\Users\Admin\AppData\Local\Temp\b017d782a26ff7c3c368a2e57efddcd3.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\SysWOW64\winver.exe
    winver
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3468

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3732

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of UnmapMainImage
PID:3880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3944

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2140

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2260

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:544

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffce2632e98,0x7ffce2632ea4,0x7ffce2632eb0
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2324 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2936 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3384 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5248 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5304 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1404 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1160

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:2024

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:4808

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3828

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1588

C:\Windows\System32\wuapihost.exe
C:\Windows\System32\wuapihost.exe -Embedding
1⤵
PID:4924

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 29ae8e38be183d844edad725e474b3c124d1c256bb91b4dc7c63e664e6612b53
MD5 541ad2ea11093e8265d28b4868bd2c9f
SHA1 18484498feef66bef820d7d4d8d9f3ab90457a15
SHA512 3a31de633b57d6188efdd7d8e8fe8a3adab13bf85f102e1b0d8747d1ccd62e0121e8f00e933ac7d31c82f0facf03b324725a3dd6160afe8ffc8b11c936218f17
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 9b275f37524fbf27f3009a2f09c3eb5e37cb316682971e7eda5a80e89ccfb88d
MD5 be615f0f7f65b5e3f6c21cbf84130a7e
SHA1 ff3fc30859728ac15b578cd37f4f1227bc4ffc76
SHA512 c031e98cd4064512f136cf8727f141c39af74d5f7b6e7374faf9ece5a510b09fb0d1d25426a07a6fce09207cf2c0a9e7b07922ac7ea2f602b627a9143b9ce0b0
SSDEEP 96:sVTZVEIIrIscDW4H1bDy+hwXuKj4PmAboo5H16ZZS9/x+6M8muecmje1yK+g59BE:sVT/I8saWc8SwpobooASj+FVj0VI6wHJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 416B
SHA256 d99b671f7177860fd88c70638b9da1a959d6f5b82a6aea2257f0e8a32d56545e
MD5 e3d49dd7c43ca6f587ba415f9b5fa2ef
SHA1 707a3c21bdf84bc0c39e4cf6914897d7c772f876
SHA512 a65d4e2db567b264f60689c80738b2f5685a9de1a7f6084cd50cf7793dd32bb5ba45f9e37cec0e4674ee93e63e07e01f2ecdafaa2e7b3eea6277bef96f395d61
MD5 SHA1 SHA512

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 213B
SHA256 d7a16c2f6d6997e3e82e5a9fa9599b060a282fee6f7ddc5a57e7a151844854f7
MD5 fd20c02631598c8fe34fdb78a1feca65
SHA1 5b21905e03658c6e9b46393773ef9247be5a7b5d
SHA512 00804d0dce3a416182680cd59fb741c9e87ea655a4046031fb3e5f01dc3239a7b0612130cb88e718215b05fcf559f586c83e9cae0f2a51aa5eec2157e7a35760
MD5 SHA1 SHA512

Submit Download

eventbeacons.dat

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\338388\eventbeacons.dat
Size 629B
SHA256 772f83a510894ab16c84b891a5f43e7f85a293b6e3b8c190b762affae64afa04
MD5 04693f724a25298da9a3ca445916c209
SHA1 9de46feff4e87da959c5364c20c165a5dc8bcd5b
SHA512 e04ddc61594b1fc11a559a6140368cdb402eafbca1ba7e952ba8b60fae00e2c18c13261452704795d7176116a22444bd0c144cd85966f788fe8398f01c5f81b4
MD5 SHA1 SHA512

Submit Download

memory/544-35-0x0000000000420000-0x0000000000426000-memory.dmp

Download

memory/544-32-0x0000000000420000-0x0000000000426000-memory.dmp

Download

memory/728-1-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/728-2-0x00000000022C0000-0x0000000002CC0000-memory.dmp

Download

memory/728-8-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/728-9-0x00000000022C0000-0x0000000002CC0000-memory.dmp

Download

memory/728-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1060-67-0x00000000005A0000-0x00000000005A6000-memory.dmp

Download

memory/1060-66-0x00000000005A0000-0x00000000005A6000-memory.dmp

Download

memory/1060-68-0x00007FFD07F40000-0x00007FFD07F41000-memory.dmp

Download

memory/1060-69-0x00007FFD07F30000-0x00007FFD07F31000-memory.dmp

Download

memory/1588-64-0x00007FFD07F30000-0x00007FFD07F31000-memory.dmp

Download

memory/1588-63-0x00007FFD07F40000-0x00007FFD07F41000-memory.dmp

Download

memory/1588-62-0x00007FFD07F20000-0x00007FFD07F21000-memory.dmp

Download

memory/1588-42-0x0000000000C90000-0x0000000000C96000-memory.dmp

Download

memory/1588-40-0x0000000000C90000-0x0000000000C96000-memory.dmp

Download

memory/2024-37-0x0000000000790000-0x0000000000796000-memory.dmp

Download

memory/2140-29-0x0000000000D30000-0x0000000000D36000-memory.dmp

Download

memory/2140-31-0x0000000000D30000-0x0000000000D36000-memory.dmp

Download

memory/2260-33-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/2260-30-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/2416-18-0x0000000000B30000-0x0000000000B36000-memory.dmp

Download

memory/2448-14-0x00000000006F0000-0x00000000006F6000-memory.dmp

Download

memory/2448-19-0x00000000006F0000-0x00000000006F6000-memory.dmp

Download

memory/2520-20-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/2520-15-0x0000000000A50000-0x0000000000A56000-memory.dmp

Download

memory/3332-5-0x0000000000890000-0x0000000000896000-memory.dmp

Download

memory/3332-7-0x00007FFD07DAD000-0x00007FFD07DAE000-memory.dmp

Download

memory/3332-16-0x00000000008B0000-0x00000000008B6000-memory.dmp

Download

memory/3332-22-0x00000000008B0000-0x00000000008B6000-memory.dmp

Download

memory/3332-10-0x00007FFD07F40000-0x00007FFD07F41000-memory.dmp

Download

memory/3468-17-0x0000000000A80000-0x0000000000A86000-memory.dmp

Download

memory/3468-24-0x0000000000A80000-0x0000000000A86000-memory.dmp

Download

memory/3732-21-0x00000000009D0000-0x00000000009D6000-memory.dmp

Download

memory/3828-44-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/3828-46-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/3828-39-0x0000000000050000-0x0000000000056000-memory.dmp

Download

memory/3828-45-0x00007FFD07F30000-0x00007FFD07F31000-memory.dmp

Download

memory/3880-23-0x0000000000230000-0x0000000000236000-memory.dmp

Download

memory/3880-65-0x00007FFD07F20000-0x00007FFD07F21000-memory.dmp

Download

memory/3880-26-0x0000000000230000-0x0000000000236000-memory.dmp

Download

memory/3880-77-0x00007FFD07F30000-0x00007FFD07F31000-memory.dmp

Download

memory/3944-25-0x0000000000240000-0x0000000000246000-memory.dmp

Download

memory/3944-27-0x0000000000240000-0x0000000000246000-memory.dmp

Download

memory/3944-71-0x00007FFD07F40000-0x00007FFD07F41000-memory.dmp

Download

memory/3944-70-0x00007FFD07F20000-0x00007FFD07F21000-memory.dmp

Download

memory/4028-28-0x0000000000D30000-0x0000000000D36000-memory.dmp

Download

memory/4808-38-0x0000000000D30000-0x0000000000D36000-memory.dmp

Download

memory/4880-34-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/4880-36-0x0000000000770000-0x0000000000776000-memory.dmp

Download

memory/4924-43-0x0000000000710000-0x0000000000716000-memory.dmp

Download

memory/4924-41-0x0000000000710000-0x0000000000716000-memory.dmp

Download

memory/5036-12-0x00000000025B0000-0x00000000025B6000-memory.dmp

Download

memory/5036-6-0x0000000077912000-0x0000000077913000-memory.dmp

Download

memory/5036-3-0x00000000025B0000-0x00000000025B6000-memory.dmp

Download