danabot | 4116fcfcfe5df39c8356a59782606b1f19ab693ce6ff1e363f8606166fcf58fb

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe
Size

1.1MB
MD5

26d32ba746528921415f4299188d0451
SHA1

0635b7b33a6f79e84dfe8fe1f7f4152d20c533c7
SHA256

4116fcfcfe5df39c8356a59782606b1f19ab693ce6ff1e363f8606166fcf58fb
SHA512

d7186313bf093a11f0e314aa225a7c36ad9f7ad1b00723103f6851c832829cf8a4abc2cb6983c646b34e38c2d7a16f3217a0efe0065d4942f4fd0ac2172d35e4
SSDEEP

24576:121pHZkUu40eoX4zuROs5obLOfkAnMNMo+C0OW/WS7H1S:mHZzu40ecUuFobafkaMNMo+plj7k

Score

10^/10

danabot 5 aspackv2 banker discovery trojan

Malware Config

Extracted

Family

danabot

Botnet

23.254.217.192:443

192.236.146.173:443

23.254.133.7:443

185.62.58.85:443

Attributes

embedded_hash
3CCDCA270E94321B76E2E66C454CD541
type
loader

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot

Blocklisted process makes network request 50 IoCs

Processes:

rundll32.exe

flow	pid	Process
5	2872	rundll32.exe
9	2872	rundll32.exe
14	2872	rundll32.exe
16	2872	rundll32.exe
17	2872	rundll32.exe
19	2872	rundll32.exe
21	2872	rundll32.exe
22	2872	rundll32.exe
23	2872	rundll32.exe
25	2872	rundll32.exe
27	2872	rundll32.exe
28	2872	rundll32.exe
29	2872	rundll32.exe
31	2872	rundll32.exe
32	2872	rundll32.exe
34	2872	rundll32.exe
35	2872	rundll32.exe
37	2872	rundll32.exe
38	2872	rundll32.exe
40	2872	rundll32.exe
41	2872	rundll32.exe
43	2872	rundll32.exe
44	2872	rundll32.exe
46	2872	rundll32.exe
47	2872	rundll32.exe
49	2872	rundll32.exe
50	2872	rundll32.exe
52	2872	rundll32.exe
53	2872	rundll32.exe
55	2872	rundll32.exe
56	2872	rundll32.exe
58	2872	rundll32.exe
59	2872	rundll32.exe
61	2872	rundll32.exe
62	2872	rundll32.exe
64	2872	rundll32.exe
65	2872	rundll32.exe
66	2872	rundll32.exe
67	2872	rundll32.exe
68	2872	rundll32.exe
69	2872	rundll32.exe
70	2872	rundll32.exe
72	2872	rundll32.exe
73	2872	rundll32.exe
74	2872	rundll32.exe
75	2872	rundll32.exe
76	2872	rundll32.exe
77	2872	rundll32.exe
78	2872	rundll32.exe
79	2872	rundll32.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
behavioral1/files/0x0007000000012117-6.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

TzovqKSc.exe

pid	Process
1880	TzovqKSc.exe

Loads dropped DLL 2 IoCs

Processes:

E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe

pid	Process
2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe
2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe

Drops file in Program Files directory 64 IoCs

Processes:

TzovqKSc.exe

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\tnameserv.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\sidebar.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\Chess.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Windows Sidebar\sidebar.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\WinMail.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{95CA7C0F-EA8C-4FCD-8952-D8E66C033579}\chrome_installer.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe	TzovqKSc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javaw.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Java\jre7\bin\policytool.exe	TzovqKSc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	TzovqKSc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exerundll32.exeTzovqKSc.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TzovqKSc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exeTzovqKSc.exe

description	pid	Process	procid_target
PID 2280 wrote to memory of 1880	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	28
PID 2280 wrote to memory of 1880	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	28
PID 2280 wrote to memory of 1880	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	28
PID 2280 wrote to memory of 1880	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	28
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 2280 wrote to memory of 2872	2280	E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe	29
PID 1880 wrote to memory of 2228	1880	TzovqKSc.exe	33
PID 1880 wrote to memory of 2228	1880	TzovqKSc.exe	33
PID 1880 wrote to memory of 2228	1880	TzovqKSc.exe	33
PID 1880 wrote to memory of 2228	1880	TzovqKSc.exe	33

C:\Users\Admin\AppData\Local\Temp\E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe
"C:\Users\Admin\AppData\Local\Temp\E1511E934906072C0717E68C0A05B04C61846F7AD15CE323B61F854A24C86B15.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\TzovqKSc.exe
  C:\Users\Admin\AppData\Local\Temp\TzovqKSc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\55234b2a.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- C:\Windows\syswow64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\55234b2a.bat

Filesize
191B

MD5
e8791d9a15db57583410df8b99b2fcf3

SHA1
3d5023ab2a464ea67c45b2d54fb1384febc6ba52

SHA256
88cc151db74700e6713cbf7e5fd5764f4fa30fa9bea8f181ab9570581adc05bc

SHA512
44cc45269255bac1f896a2793b3ee11964a4a184947fbd81f548d5a994827b383a55ed9ebe214fb23f5cb90db996ad1dfe7de95d505ac9eb6168cd2e7d71124a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TzovqKSc.exe

Filesize
15KB

MD5
f7d21de5c4e81341eccd280c11ddcc9a

SHA1
d4e9ef10d7685d491583c6fa93ae5d9105d815bd

SHA256
4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794

SHA512
e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

Download Submit
memory/1880-71-0x0000000000D80000-0x0000000000D89000-memory.dmp

Filesize
36KB

Download
memory/1880-11-0x0000000000D80000-0x0000000000D89000-memory.dmp

Filesize
36KB

Download
memory/2280-18-0x0000000000400000-0x0000000000630000-memory.dmp

Filesize
2.2MB

Download
memory/2280-21-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2280-16-0x0000000000220000-0x00000000002FD000-memory.dmp

Filesize
884KB

Download
memory/2280-17-0x0000000001EF0000-0x0000000002113000-memory.dmp

Filesize
2.1MB

Download
memory/2280-9-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2280-19-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2280-20-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2280-15-0x0000000000220000-0x00000000002FD000-memory.dmp

Filesize
884KB

Download
memory/2280-84-0x0000000000400000-0x0000000000630000-memory.dmp

Filesize
2.2MB

Download
memory/2280-82-0x0000000001EF0000-0x0000000002113000-memory.dmp

Filesize
2.1MB

Download
memory/2280-80-0x0000000000220000-0x00000000002FD000-memory.dmp

Filesize
884KB

Download
memory/2280-75-0x0000000000400000-0x0000000000635000-memory.dmp

Filesize
2.2MB

Download
memory/2280-10-0x0000000000D80000-0x0000000000D89000-memory.dmp

Filesize
36KB

Download
memory/2280-12-0x0000000000D80000-0x0000000000D89000-memory.dmp

Filesize
36KB

Download
memory/2872-74-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-24-0x0000000000250000-0x0000000000253000-memory.dmp

Filesize
12KB

Download
memory/2872-60-0x0000000077600000-0x0000000077601000-memory.dmp

Filesize
4KB

Download
memory/2872-73-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-62-0x0000000075CD0000-0x0000000075DD0000-memory.dmp

Filesize
1024KB

Download
memory/2872-61-0x0000000075CF0000-0x0000000075CF1000-memory.dmp

Filesize
4KB

Download
memory/2872-76-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-77-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-79-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-58-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-81-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-22-0x0000000000250000-0x0000000000253000-memory.dmp

Filesize
12KB

Download
memory/2872-83-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-59-0x0000000000080000-0x0000000000083000-memory.dmp

Filesize
12KB

Download
memory/2872-85-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-87-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-88-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-89-0x0000000075CD0000-0x0000000075DD0000-memory.dmp

Filesize
1024KB

Download
memory/2872-90-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-91-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-92-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-94-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-95-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-96-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-98-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-99-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download
memory/2872-101-0x0000000000090000-0x0000000000093000-memory.dmp

Filesize
12KB

Download