qakbot | 798e44b2af6329ac38f144d816096b72889009f44c9d74aefa36c11dbdc5522a

Analysis

max time kernel
148s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32432f63ce811f734d1938060fe83b4c_JaffaCakes118.vbs
Size

1.9MB
MD5

32432f63ce811f734d1938060fe83b4c
SHA1

e768c6bf965a548f8e8e79413d67998ee5173364
SHA256

798e44b2af6329ac38f144d816096b72889009f44c9d74aefa36c11dbdc5522a
SHA512

d41328ae22eb0768c70567c7759ed9164112c47f4c81ffb3c3b387c0f8fe33b29725d25cd5b8b390c9feca405d9f426cb823ed8ec5b91d7a139ae5de742e9351
SSDEEP

49152:bs87tFIYKrGSBUsthSxelQwz1w9r+U32mIXzTmCc4iMVWS:k

Score

10^/10

qakbot spx04 1568039940 banker evasion persistence stealer trojan

Malware Config

Extracted

Family

qakbot

Version

323.79

Botnet

spx04

Campaign

1568039940

190.120.196.18:443

70.169.2.228:21

189.160.191.239:443

174.48.72.160:443

99.231.208.9:443

12.5.37.3:443

173.178.129.3:443

189.236.138.168:443

67.41.197.173:2078

173.172.205.216:443

76.69.181.244:995

70.164.39.91:443

75.131.72.82:443

189.236.214.160:995

199.126.92.231:995

98.224.57.108:443

72.142.106.198:995

98.186.90.192:995

72.36.14.160:443

75.177.172.209:6882

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
Turns off Windows Defender SpyNet reporting 2 TTPs
evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag = "0"	reg.exe

Executes dropped EXE 7 IoCs

pid	Process
2832	FrWqwyW.exe
2696	FrWqwyW.exe
2640	zvlfsg.exe
2752	zvlfsg.exe
2324	FrWqwyW.exe
2036	zvlfsg.exe
3004	zvlfsg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\saxbnmet = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Eojlag\\zvlfsg.exe\""	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	zvlfsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	zvlfsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	zvlfsg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	zvlfsg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	FrWqwyW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	zvlfsg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	zvlfsg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	zvlfsg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	FrWqwyW.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	zvlfsg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	zvlfsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	zvlfsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	zvlfsg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	zvlfsg.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2164	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	FrWqwyW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	FrWqwyW.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
436	PING.EXE

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2832	FrWqwyW.exe
2832	FrWqwyW.exe
2696	FrWqwyW.exe
2696	FrWqwyW.exe
2696	FrWqwyW.exe
2696	FrWqwyW.exe
2640	zvlfsg.exe
2640	zvlfsg.exe
2752	zvlfsg.exe
2752	zvlfsg.exe
2752	zvlfsg.exe
2752	zvlfsg.exe
2288	explorer.exe
2288	explorer.exe
2288	explorer.exe
2288	explorer.exe
2324	FrWqwyW.exe
2324	FrWqwyW.exe
2036	zvlfsg.exe
2036	zvlfsg.exe
3004	zvlfsg.exe
3004	zvlfsg.exe
3004	zvlfsg.exe
3004	zvlfsg.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2640	zvlfsg.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2696	2832	FrWqwyW.exe	96
PID 2832 wrote to memory of 2696	2832	FrWqwyW.exe	96
PID 2832 wrote to memory of 2696	2832	FrWqwyW.exe	96
PID 2832 wrote to memory of 2640	2832	FrWqwyW.exe	97
PID 2832 wrote to memory of 2640	2832	FrWqwyW.exe	97
PID 2832 wrote to memory of 2640	2832	FrWqwyW.exe	97
PID 2832 wrote to memory of 2164	2832	FrWqwyW.exe	98
PID 2832 wrote to memory of 2164	2832	FrWqwyW.exe	98
PID 2832 wrote to memory of 2164	2832	FrWqwyW.exe	98
PID 2640 wrote to memory of 2752	2640	zvlfsg.exe	100
PID 2640 wrote to memory of 2752	2640	zvlfsg.exe	100
PID 2640 wrote to memory of 2752	2640	zvlfsg.exe	100
PID 2640 wrote to memory of 2288	2640	zvlfsg.exe	101
PID 2640 wrote to memory of 2288	2640	zvlfsg.exe	101
PID 2640 wrote to memory of 2288	2640	zvlfsg.exe	101
PID 2640 wrote to memory of 2288	2640	zvlfsg.exe	101
PID 2324 wrote to memory of 1668	2324	FrWqwyW.exe	112
PID 2324 wrote to memory of 1668	2324	FrWqwyW.exe	112
PID 2324 wrote to memory of 3680	2324	FrWqwyW.exe	114
PID 2324 wrote to memory of 3680	2324	FrWqwyW.exe	114
PID 2324 wrote to memory of 3700	2324	FrWqwyW.exe	116
PID 2324 wrote to memory of 3700	2324	FrWqwyW.exe	116
PID 2324 wrote to memory of 4436	2324	FrWqwyW.exe	118
PID 2324 wrote to memory of 4436	2324	FrWqwyW.exe	118
PID 2324 wrote to memory of 1240	2324	FrWqwyW.exe	120
PID 2324 wrote to memory of 1240	2324	FrWqwyW.exe	120
PID 2324 wrote to memory of 760	2324	FrWqwyW.exe	122
PID 2324 wrote to memory of 760	2324	FrWqwyW.exe	122
PID 2324 wrote to memory of 3100	2324	FrWqwyW.exe	124
PID 2324 wrote to memory of 3100	2324	FrWqwyW.exe	124
PID 2324 wrote to memory of 2060	2324	FrWqwyW.exe	126
PID 2324 wrote to memory of 2060	2324	FrWqwyW.exe	126
PID 2324 wrote to memory of 4104	2324	FrWqwyW.exe	128
PID 2324 wrote to memory of 4104	2324	FrWqwyW.exe	128
PID 2324 wrote to memory of 2036	2324	FrWqwyW.exe	130
PID 2324 wrote to memory of 2036	2324	FrWqwyW.exe	130
PID 2324 wrote to memory of 2036	2324	FrWqwyW.exe	130
PID 2324 wrote to memory of 3120	2324	FrWqwyW.exe	131
PID 2324 wrote to memory of 3120	2324	FrWqwyW.exe	131
PID 2324 wrote to memory of 3788	2324	FrWqwyW.exe	132
PID 2324 wrote to memory of 3788	2324	FrWqwyW.exe	132
PID 3120 wrote to memory of 436	3120	cmd.exe	135
PID 3120 wrote to memory of 436	3120	cmd.exe	135
PID 2036 wrote to memory of 3004	2036	zvlfsg.exe	136
PID 2036 wrote to memory of 3004	2036	zvlfsg.exe	136
PID 2036 wrote to memory of 3004	2036	zvlfsg.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\32432f63ce811f734d1938060fe83b4c_JaffaCakes118.vbs"
1⤵
PID:1488

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
  C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /C
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  PID:2696
- C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:2752
- - C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    3⤵
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2288
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn szxlxrum /tr "\"C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe\" /I szxlxrum" /SC ONCE /Z /ST 02:32 /ET 02:44
  2⤵
  - Creates scheduled task(s)
  PID:2164

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe
C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe /I szxlxrum
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:1668
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:3680
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:3700
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:4436
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:1240
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:760
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SpyNetReporting" /d "0"
  2⤵
  PID:3100
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet" /f /t REG_DWORD /v "SubmitSamplesConsent" /d "2"
  2⤵
  PID:2060
- C:\Windows\system32\reg.exe
  C:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag" /d "0"
  2⤵
  - Windows security bypass
  PID:4104
- C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.exe /C
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\System32\calc.exe" > "C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\system32\PING.EXE
    ping.exe -n 6 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:436
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /DELETE /F /TN szxlxrum
  2⤵
  PID:3788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FrWqwyW.exe

Filesize
660KB

MD5
048a451e99556b0f90576c2a976073d7

SHA1
1d3bc3472ec2313038f120020e3ce54db3db72f3

SHA256
f5d56d68b93516d18564a7862f2494e99827a0bd9071476e0585a2a345e7879a

SHA512
eb2aff455619c4dda5ed02f1b46a36a065d26671b55a8c94c8d47cd50419288b3937ebc014c9a5fc3dc3bc8a7223e5bfa54b963575cda0606b2f611e4ad9f3d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Eojlag\zvlfsg.dat

Filesize
63B

MD5
2d46a1fbebe23b6c53f2d9819148b0d8

SHA1
6e9366026fc9158d3cccea519c44a6f64dd9edeb

SHA256
12df80c5b68fc5dc5a908a490a39b6a1f9a5191fd518dd12980c743612450376

SHA512
62992b63c7e501513b6339399f016fd4de82698cc74413e54c6bd2280029e276e5fc12b83c778b3179bed04eddb66fdd23b2c95f0d9528e4b4ee6f1bde56be8c

Download Submit
memory/2036-56-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2288-39-0x0000000002F70000-0x0000000002FB0000-memory.dmp

Filesize
256KB

Download
memory/2288-34-0x0000000000F10000-0x0000000000FA1000-memory.dmp

Filesize
580KB

Download
memory/2288-36-0x0000000002F70000-0x0000000002FB0000-memory.dmp

Filesize
256KB

Download
memory/2288-37-0x0000000002F70000-0x0000000002FB0000-memory.dmp

Filesize
256KB

Download
memory/2288-33-0x0000000002F70000-0x0000000002FB0000-memory.dmp

Filesize
256KB

Download
memory/2288-30-0x0000000000F10000-0x0000000000FA1000-memory.dmp

Filesize
580KB

Download
memory/2288-32-0x0000000000F10000-0x0000000000FA1000-memory.dmp

Filesize
580KB

Download
memory/2324-43-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2324-50-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2640-35-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2640-23-0x00000000021D0000-0x0000000002261000-memory.dmp

Filesize
580KB

Download
memory/2696-9-0x0000000002170000-0x0000000002201000-memory.dmp

Filesize
580KB

Download
memory/2696-13-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2752-29-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2832-24-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2832-5-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2832-4-0x0000000002260000-0x00000000022F1000-memory.dmp

Filesize
580KB

Download
memory/3004-55-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download