danabot | 19524f18ed92072060b9e7cb4bc49b2c8a48341f42dd981fbb9989798f1ca1fa

Analysis

max time kernel
144s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe
Size

4.0MB
MD5

8f129ca0e882e49208ef4749bfaab916
SHA1

6a44d8e9af5097a8f2fd5e9928fd1d29c483aa53
SHA256

19524f18ed92072060b9e7cb4bc49b2c8a48341f42dd981fbb9989798f1ca1fa
SHA512

d97b9a0b5d8dd80a0138eb4e33ec00be66e57f5978eb1614d05c0d60c6390a546097e454249ca207aa1f6ec04fcf2e44cdca4a84dfc5bd905f2a9d9c0991987d
SSDEEP

98304:fpvKw4l/aCvEhf/EtxpQD4x1K0hp476EtDF:f8NHEdEzy4DK0hp476I

Score

10^/10

danabot 3 banker collection credential_access discovery execution spyware stealer trojan

Malware Config

Extracted

Family

danabot

Version

1765

Botnet

79.124.78.236:443

134.119.186.199:443

192.236.162.42:443

134.119.186.198:443

Attributes

embedded_hash
82C66843DE542BC5CB88F713DE39B52B
type
main

rsa_pubkey.plain

Signatures

Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Blocklisted process makes network request 4 IoCs

Processes:

RUNDLL32.EXE

flow	pid	Process
4	2804	RUNDLL32.EXE
5	2804	RUNDLL32.EXE
8	2804	RUNDLL32.EXE
9	2804	RUNDLL32.EXE

Deletes itself 1 IoCs

Processes:

rundll32.exe

pid	Process
1880	rundll32.exe

Loads dropped DLL 8 IoCs

Processes:

rundll32.exeRUNDLL32.EXE

pid	Process
1880	rundll32.exe
1880	rundll32.exe
1880	rundll32.exe
1880	rundll32.exe
2804	RUNDLL32.EXE
2804	RUNDLL32.EXE
2804	RUNDLL32.EXE
2804	RUNDLL32.EXE

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	RUNDLL32.EXE

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RUNDLL32.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

Processes:

RUNDLL32.EXE

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	RUNDLL32.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\RTJA0BV0\desktop.ini	RUNDLL32.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\386UAANV\desktop.ini	RUNDLL32.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2552	powershell.exe
2072	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exepowershell.exenslookup.exeschtasks.exeschtasks.exe8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exerundll32.exeRUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RUNDLL32.EXE

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RUNDLL32.EXE

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	RUNDLL32.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	RUNDLL32.EXE
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	RUNDLL32.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	RUNDLL32.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeRUNDLL32.EXEpowershell.exe

pid	Process
2552	powershell.exe
2804	RUNDLL32.EXE
2804	RUNDLL32.EXE
2072	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rundll32.exeRUNDLL32.EXEpowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	1880	rundll32.exe
Token: SeDebugPrivilege	2804	RUNDLL32.EXE
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeDebugPrivilege	2072	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

RUNDLL32.EXE

pid	Process
2804	RUNDLL32.EXE

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exerundll32.exeRUNDLL32.EXEpowershell.exe

description	pid	Process	procid_target
PID 2732 wrote to memory of 1880	2732	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe	31
PID 2732 wrote to memory of 1880	2732	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe	31
PID 2732 wrote to memory of 1880	2732	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe	31
PID 2732 wrote to memory of 1880	2732	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe	31
PID 2732 wrote to memory of 1880	2732	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe	31
PID 2732 wrote to memory of 1880	2732	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe	31
PID 2732 wrote to memory of 1880	2732	8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe	31
PID 1880 wrote to memory of 2804	1880	rundll32.exe	32
PID 1880 wrote to memory of 2804	1880	rundll32.exe	32
PID 1880 wrote to memory of 2804	1880	rundll32.exe	32
PID 1880 wrote to memory of 2804	1880	rundll32.exe	32
PID 1880 wrote to memory of 2804	1880	rundll32.exe	32
PID 1880 wrote to memory of 2804	1880	rundll32.exe	32
PID 1880 wrote to memory of 2804	1880	rundll32.exe	32
PID 2804 wrote to memory of 2552	2804	RUNDLL32.EXE	33
PID 2804 wrote to memory of 2552	2804	RUNDLL32.EXE	33
PID 2804 wrote to memory of 2552	2804	RUNDLL32.EXE	33
PID 2804 wrote to memory of 2552	2804	RUNDLL32.EXE	33
PID 2804 wrote to memory of 2072	2804	RUNDLL32.EXE	36
PID 2804 wrote to memory of 2072	2804	RUNDLL32.EXE	36
PID 2804 wrote to memory of 2072	2804	RUNDLL32.EXE	36
PID 2804 wrote to memory of 2072	2804	RUNDLL32.EXE	36
PID 2072 wrote to memory of 1744	2072	powershell.exe	38
PID 2072 wrote to memory of 1744	2072	powershell.exe	38
PID 2072 wrote to memory of 1744	2072	powershell.exe	38
PID 2072 wrote to memory of 1744	2072	powershell.exe	38
PID 2804 wrote to memory of 928	2804	RUNDLL32.EXE	39
PID 2804 wrote to memory of 928	2804	RUNDLL32.EXE	39
PID 2804 wrote to memory of 928	2804	RUNDLL32.EXE	39
PID 2804 wrote to memory of 928	2804	RUNDLL32.EXE	39
PID 2804 wrote to memory of 2648	2804	RUNDLL32.EXE	41
PID 2804 wrote to memory of 2648	2804	RUNDLL32.EXE	41
PID 2804 wrote to memory of 2648	2804	RUNDLL32.EXE	41
PID 2804 wrote to memory of 2648	2804	RUNDLL32.EXE	41

outlook_office_path 1 IoCs

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

outlook_win_path 1 IoCs

Processes:

RUNDLL32.EXE

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RUNDLL32.EXE

C:\Users\Admin\AppData\Local\Temp\8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f129ca0e882e49208ef4749bfaab916_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\8F129C~1.DLL,Z C:\Users\Admin\AppData\Local\Temp\8F129C~1.EXE
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\RUNDLL32.EXE
    C:\Windows\system32\RUNDLL32.EXE C:\Users\Admin\AppData\Local\Temp\8F129C~1.DLL,QzESNJ90
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook accounts
    - Accesses Microsoft Outlook profiles
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:2804
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp1287.tmp.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2552
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Executionpolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\tmp19AA.tmp.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\Windows\SysWOW64\nslookup.exe
        
        "C:\Windows\system32\nslookup.exe" -type=any localhost
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /End /tn \Microsoft\Windows\Wininet\CacheTask
      4⤵
      System Location Discovery: System Language Discovery
      PID:928
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /tn \Microsoft\Windows\Wininet\CacheTask
      4⤵
      System Location Discovery: System Language Discovery
      PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\386UAANV\desktop.ini

Filesize
67B

MD5
4a3deb274bb5f0212c2419d3d8d08612

SHA1
fa52f823b821155cf0ec527d52ce9b1390ec615e

SHA256
2842973d15a14323e08598be1dfb87e54bf88a76be8c7bc94c56b079446edf38

SHA512
34d1a29c9142fc5a875733c49886ad52a077045831aaa79239712bcd0f312637ba86882a71d37d9d68789ef53e30be5d3470f56d03377cd1eeded98af898ff80

Download Submit
C:\Users\Admin\AppData\Local\Temp\8F129C~1.DLL

Filesize
3.8MB

MD5
0fa776ebc6c175716ddae5d5ce2a5894

SHA1
3dbb9ac31089481cdba10345889f73d9acb59a02

SHA256
fda53157a533ba28a067f49b29c517b1e7ac91cba890aa5bcb2ed245a036cdd7

SHA512
55d11b53fe9134bf8b43a017591a27bedb9d539c5bac03e93cd3cd4a8a96b3f7030b9ad9fec373a0cf6e88a0776f32a3c57388dcb6114e895733fd45a5922b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\odleug.tmp

Filesize
2KB

MD5
173c4079de4dcdabf8395424a8e4f28b

SHA1
57bf804306b9c32e009b57672f93ad1d31f43f63

SHA256
1bf6ebf6df510f4448dd62fde59e7bb4de65ee5f18467f64c9d81657b29221f1

SHA512
5574de7a56ff44a5098a1d12269ca1283b26d80bc24b339e7b24c83dd041cc137cbeb9e1fe1241dcefa84aae8920c5c297ce42cbba8b4d18206606432942215b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1287.tmp.ps1

Filesize
261B

MD5
a579d6164907e9371c100a15312650ca

SHA1
1f4979c2605a8ccb234b133fe827cc49e1313e99

SHA256
66bdd70a40eda54bdaa6f1ed52d169578bd9e30b5e496929b239d0ba10c292ae

SHA512
630c646bc46d8ab8b91e93cde7c76458e225d353372aa190f249f5abd0f29cc6b621b8d0e66038df65864f7a1bd23da8cefd0f5ba56eff6d2ccecc674bfc2ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp19AA.tmp.ps1

Filesize
80B

MD5
81b5d8049fd43e012790de971b968d45

SHA1
aabaad16da9c4153cdd45ad15b5f87995f16a306

SHA256
475a5a4d8681d4fd952272ef608b311f8e21477ce692d8cbb8dfd13b7b652b9b

SHA512
332aff0cf59b123e05ef2c5450f6527cb66dd0d9764488329114b03fa35cc6b5adc0cccd6c1526c42c2fe8ee723d540d902d9e5d6404ac504c4b93690cb1179e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp19AB.tmp

Filesize
86B

MD5
1860260b2697808b80802352fe324782

SHA1
f07b4cb6a8133d8dd942fc285d63cb3ce5a1ed6b

SHA256
0c4bb6ae7726faa47aef8459bcf37bf9ca16f0b93fd52790932adaf7845d1fb1

SHA512
d9fd458e2fe871e93199d7f3783133ded898d824024d9525e8c9af2af31892b13f3fb147d3bfda7dfd7659b7072f5cd1d6c3ebfe2dbf5893afd00e59a96aa94f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
03c1d6040a9953fb9bf8baa3d5459be9

SHA1
88aecdfb32876f30fa208cc45c6d4b81c10b3558

SHA256
422030b38d2c1bed7afcf45b763063a5d9e4cb33b881ffb5e34809d0b3612b79

SHA512
9419a05a6bd25de862f061e22e34d6a2eaaeb0b9ba39a02bd0fcedd3fe56c2cf2c27c18b27bdaef3f7388574db13d587fc399608553fe51f31c9833010e52f1c

Download Submit
memory/1880-12-0x0000000002580000-0x000000000294D000-memory.dmp

Filesize
3.8MB

Download
memory/1880-14-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/1880-15-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/1880-16-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/1880-17-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/2732-7-0x00000000030F0000-0x00000000034BC000-memory.dmp

Filesize
3.8MB

Download
memory/2732-0-0x00000000030F0000-0x00000000034BC000-memory.dmp

Filesize
3.8MB

Download
memory/2732-1-0x00000000030F0000-0x00000000034BC000-memory.dmp

Filesize
3.8MB

Download
memory/2732-2-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2732-5-0x0000000000400000-0x00000000007EA000-memory.dmp

Filesize
3.9MB

Download
memory/2732-70-0x0000000000400000-0x0000000002F80000-memory.dmp

Filesize
43.5MB

Download
memory/2732-13-0x0000000000400000-0x0000000002F80000-memory.dmp

Filesize
43.5MB

Download
memory/2732-4-0x0000000000400000-0x0000000002F80000-memory.dmp

Filesize
43.5MB

Download
memory/2804-48-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/2804-23-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/2804-68-0x0000000002580000-0x000000000294D000-memory.dmp

Filesize
3.8MB

Download
memory/2804-24-0x0000000003670000-0x0000000003671000-memory.dmp

Filesize
4KB

Download
memory/2804-82-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/2804-83-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/2804-25-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/2804-26-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download
memory/2804-27-0x0000000002FF0000-0x0000000003652000-memory.dmp

Filesize
6.4MB

Download