trickbot | 593cdb3ba3206c38c5e4509137299d8a281601c6f1e7d26da51c605b1e2aed9c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
Size

416KB
MD5

dbcbce3e7e88b94f9f0274dfae437ba4
SHA1

68932011b7e60604c60f91e9fb72316fbcf19faa
SHA256

593cdb3ba3206c38c5e4509137299d8a281601c6f1e7d26da51c605b1e2aed9c
SHA512

0d039571dc858b85af4ceae930f81e403bd677e0ed504fe60cb38e52b3a1351320e517060cd3dc1e9751ed7bab076d9b31a758ba51de0c3a9a36dd96827ab73e
SSDEEP

12288:5NopwClt/FVEskKgo+FH6vcEsAZONlLK/YA:voyU/EqgnHgAAZki

Score

10^/10

trickbot tot340 banker discovery evasion execution trojan

Malware Config

Extracted

Family

trickbot

Version

1000287

Botnet

tot340

193.111.63.208:443

68.3.14.71:443

174.105.235.178:449

5.196.131.249:443

181.113.17.230:449

205.157.150.98:443

185.251.38.187:443

207.140.14.141:443

42.115.91.177:443

54.39.167.242:443

71.94.101.25:443

68.45.243.125:449

82.202.236.66:443

74.140.160.33:449

76.181.182.166:449

140.190.54.187:449

82.222.40.119:449

24.119.69.70:449

188.68.208.242:443

103.110.91.118:449

Attributes

autorun
Control:GetSystemInfo
Name:systeminfo
Name:injectDll
Name:pwgrab

ecc_pubkey.base64

Signatures

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 1 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

Processes:

resource	yara_rule
behavioral1/memory/2700-17-0x00000000002D0000-0x0000000000310000-memory.dmp	trickbot_loader32

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

Processes:

dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe

pid	Process
2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
376	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe

Loads dropped DLL 2 IoCs

Processes:

dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe

pid	Process
2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
3000	powershell.exe
2116	powershell.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
2	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid	Process
2684	sc.exe
2664	sc.exe
2880	sc.exe
2836	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exesc.execmd.exedbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exepowershell.execmd.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exesc.execmd.exesc.exesc.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.execmd.exepowershell.execmd.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exepowershell.exepowershell.exe

pid	Process
2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
3000	powershell.exe
2116	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe

description	pid	Process
Token: SeDebugPrivilege	3000	powershell.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeTcbPrivilege	376	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe

pid	Process
2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
376	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.execmd.execmd.exedbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.execmd.exe

description	pid	Process	procid_target
PID 2700 wrote to memory of 2588	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2588	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2588	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2588	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	30
PID 2700 wrote to memory of 1936	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	31
PID 2700 wrote to memory of 1936	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	31
PID 2700 wrote to memory of 1936	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	31
PID 2700 wrote to memory of 1936	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	31
PID 2700 wrote to memory of 2112	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	33
PID 2700 wrote to memory of 2112	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	33
PID 2700 wrote to memory of 2112	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	33
PID 2700 wrote to memory of 2112	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	33
PID 2700 wrote to memory of 2728	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	36
PID 2700 wrote to memory of 2728	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	36
PID 2700 wrote to memory of 2728	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	36
PID 2700 wrote to memory of 2728	2700	dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe	36
PID 2588 wrote to memory of 2880	2588	cmd.exe	37
PID 2588 wrote to memory of 2880	2588	cmd.exe	37
PID 2588 wrote to memory of 2880	2588	cmd.exe	37
PID 2588 wrote to memory of 2880	2588	cmd.exe	37
PID 1936 wrote to memory of 2836	1936	cmd.exe	38
PID 1936 wrote to memory of 2836	1936	cmd.exe	38
PID 1936 wrote to memory of 2836	1936	cmd.exe	38
PID 1936 wrote to memory of 2836	1936	cmd.exe	38
PID 2728 wrote to memory of 2936	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	39
PID 2728 wrote to memory of 2936	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	39
PID 2728 wrote to memory of 2936	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	39
PID 2728 wrote to memory of 2936	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	39
PID 2728 wrote to memory of 2108	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	40
PID 2728 wrote to memory of 2108	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	40
PID 2728 wrote to memory of 2108	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	40
PID 2728 wrote to memory of 2108	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	40
PID 2112 wrote to memory of 3000	2112	cmd.exe	42
PID 2112 wrote to memory of 3000	2112	cmd.exe	42
PID 2112 wrote to memory of 3000	2112	cmd.exe	42
PID 2112 wrote to memory of 3000	2112	cmd.exe	42
PID 2728 wrote to memory of 2792	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	43
PID 2728 wrote to memory of 2792	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	43
PID 2728 wrote to memory of 2792	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	43
PID 2728 wrote to memory of 2792	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	43
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45
PID 2728 wrote to memory of 2624	2728	dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\dbcbce3e7e88b94f9f0274dfae437ba4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2880
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- C:\Users\Admin\AppData\Roaming\WSOG\dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\WSOG\dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    /c sc stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    /c sc delete WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108
  - - C:\Windows\SysWOW64\sc.exe
      sc delete WinDefend
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2792
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2624

C:\Windows\system32\taskeng.exe
taskeng.exe {2889B7D5-46A1-4EED-9B45-55EFCA25DEB1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1852
- C:\Users\Admin\AppData\Roaming\WSOG\dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
  C:\Users\Admin\AppData\Roaming\WSOG\dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:376
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:1800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
8f5c7db563c75309de3496dc2d0aab8e

SHA1
9ee5f17a03d5d62a9c10ca2ee8f86e28470d221f

SHA256
0893692e91f8813d54f75b969c2fb35a0ce2850892996204a4c35979c0750d2a

SHA512
9b3efec5d96c8aa1710ec52f1554e1ec52924e04105e76d304c10a4b4fe5ece8e569a3049aa68c4213128a0585559247ac0c0fc2fd1ffda5f4f62fadd8abed02

Download Submit
C:\Users\Admin\AppData\Roaming\WSOG\dbcbce3e8e99b94f9f0284dfae438ba4_KaffaDaket119.exe

Filesize
416KB

MD5
dbcbce3e7e88b94f9f0274dfae437ba4

SHA1
68932011b7e60604c60f91e9fb72316fbcf19faa

SHA256
593cdb3ba3206c38c5e4509137299d8a281601c6f1e7d26da51c605b1e2aed9c

SHA512
0d039571dc858b85af4ceae930f81e403bd677e0ed504fe60cb38e52b3a1351320e517060cd3dc1e9751ed7bab076d9b31a758ba51de0c3a9a36dd96827ab73e

Download Submit
memory/376-83-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-80-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-72-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-74-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-75-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-76-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-77-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-78-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-79-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-81-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-82-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-84-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-85-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/376-73-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2624-53-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/2624-54-0x0000000140000000-0x0000000140039000-memory.dmp

Filesize
228KB

Download
memory/2700-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-17-0x00000000002D0000-0x0000000000310000-memory.dmp

Filesize
256KB

Download
memory/2700-12-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-3-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-15-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-16-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-13-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-19-0x0000000000423000-0x0000000000424000-memory.dmp

Filesize
4KB

Download
memory/2700-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-5-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-20-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2700-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-9-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-10-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-11-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2728-48-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2728-50-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/2728-49-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download